Fallos del tipo CWE-862

9294 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2023-42655MEDIUMIn sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2025-48599HIGHIn multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permissioEPSS 0.1%CVE-2023-40105MEDIUMIn backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. ThisEPSS 0.1%CVE-2023-48339MEDIUMIn jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privilegeEPSS 0.1%CVE-2025-22439HIGHIn onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing perEPSS 0.1%CVE-2022-48448MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2023-20726LOWIn mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with noEPSS 0.1%CVE-2025-22414HIGHIn FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This coulEPSS 0.1%CVE-2026-18058HIGHThe mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation cEPSS 0.1%CVE-2025-26450HIGHIn onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defaEPSS 0.1%CVE-2024-40652HIGHIn onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a mEPSS 0.1%CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2025-26437MEDIUMIn CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missingEPSS 0.1%CVE-2026-15060MEDIUMsystemd-machined: unprivileged users can terminate arbitrary processesEPSS 0.1%CVE-2025-26445MEDIUMIn offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead tEPSS 0.1%CVE-2026-106367HIGHMissing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineeringEPSS 0.1%CVE-2018-9382HIGHIn multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing pEPSS 0.1%CVE-2025-48617HIGHIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to lEPSS 0.1%CVE-2026-0145MEDIUMIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2026-56952MEDIUMIn platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could EPSS 0.1%