Fallos del tipo CWE-862

9294 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2026-0145MEDIUMIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2026-45524HIGHIn isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escaEPSS 0.1%CVE-2024-0028MEDIUMIn Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could EPSS 0.1%CVE-2026-0192MEDIUMIn Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privileEPSS 0.1%CVE-2025-26418HIGHIn setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toEPSS 0.1%CVE-2025-48575HIGHIn multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead toEPSS 0.1%CVE-2026-0133HIGHIn smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permissiEPSS 0.1%CVE-2026-0158MEDIUMIn Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disEPSS 0.1%CVE-2026-0054LOWIn isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission cheEPSS 0.1%CVE-2026-0057LOWIn Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission EPSS 0.1%CVE-2026-25267HIGHMissing Authorization in CoreEPSS 0.1%CVE-2026-107426HIGHWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerabilityEPSS —CVE-2026-110622HIGHPapermerge Core through 3.5.3 Missing Authorization in Page Management and OCR EndpointsEPSS —CVE-2026-107417MEDIUMWordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerabilityEPSS —CVE-2026-107795HIGHImproper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management APIEPSS —CVE-2026-110888MEDIUMWordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerabilityEPSS —CVE-2026-111353MEDIUMPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload EndpointsEPSS —CVE-2026-46708MEDIUMEspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to recordEPSS —CVE-2026-97712HIGHNexus Repository 3 - Privilege Escalation via Role ManagementEPSS —CVE-2026-110623HIGHPapermerge Core through 3.5.3 Missing Authorization in Shared Nodes APIEPSS —