Fallos del tipo CWE-862

9294 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2023-20726LOWIn mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with noEPSS 0.1%CVE-2022-48448MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2026-18058HIGHThe mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation cEPSS 0.1%CVE-2024-40652HIGHIn onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a mEPSS 0.1%CVE-2025-26450HIGHIn onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defaEPSS 0.1%CVE-2026-15060MEDIUMsystemd-machined: unprivileged users can terminate arbitrary processesEPSS 0.1%CVE-2025-26437MEDIUMIn CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missingEPSS 0.1%CVE-2025-26445MEDIUMIn offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead tEPSS 0.1%CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2025-48617HIGHIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to lEPSS 0.1%CVE-2018-9382HIGHIn multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing pEPSS 0.1%CVE-2023-52352MEDIUMIn Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execEPSS 0.1%CVE-2026-0145MEDIUMIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2026-56952MEDIUMIn platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could EPSS 0.1%CVE-2024-0028MEDIUMIn Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could EPSS 0.1%CVE-2026-45524HIGHIn isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escaEPSS 0.1%CVE-2026-0192MEDIUMIn Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privileEPSS 0.1%CVE-2025-26418HIGHIn setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toEPSS 0.1%CVE-2025-48575HIGHIn multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead toEPSS 0.1%CVE-2026-0158MEDIUMIn Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disEPSS 0.1%