Fallos del tipo CWE-862

7094 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2023-38460HIGHIn vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2025-48524MEDIUMIn isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local dEPSS 0.1%CVE-2023-20826MEDIUMIn cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with nEPSS 0.1%CVE-2025-0076LOWIn multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead toEPSS 0.1%CVE-2025-48617HIGHIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to lEPSS 0.1%CVE-2025-48604MEDIUMIn multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local iEPSS 0.1%CVE-2018-9382HIGHIn multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing pEPSS 0.1%CVE-2025-22439HIGHIn onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing perEPSS 0.1%CVE-2023-52352MEDIUMIn Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execEPSS 0.1%CVE-2025-26450HIGHIn onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defaEPSS 0.1%CVE-2025-22414HIGHIn FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This coulEPSS 0.1%CVE-2026-26103HIGHUdisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus apiEPSS 0.1%CVE-2025-48599HIGHIn multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permissioEPSS 0.1%CVE-2026-26104MEDIUMUdisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus apiEPSS 0.1%CVE-2025-26437MEDIUMIn CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missingEPSS 0.1%CVE-2025-26445MEDIUMIn offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead tEPSS 0.1%CVE-2024-0028MEDIUMIn Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could EPSS 0.1%CVE-2026-0145LOWIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2025-26418HIGHIn setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toEPSS 0.1%