Falhas do tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2025-66319LOWPermission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect serviceEPSS 0.1%CVE-2024-5465MEDIUMFunction vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2024-51527MEDIUMPermission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2026-24920MEDIUMPermission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-46587MEDIUMPermission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidEPSS 0.1%CVE-2026-24931MEDIUMVulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect servEPSS 0.1%CVE-2024-21469HIGHPermissions, Privileges, and Access Control issues in TZ Secure OSEPSS 0.1%CVE-2021-25472MEDIUMAn improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrEPSS 0.1%CVE-2025-54608MEDIUMVulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: SuccessEPSS 0.1%CVE-2025-58283MEDIUMPermission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58302HIGHPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2025-58284MEDIUMPermission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-54654MEDIUMPermission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-53186MEDIUMVulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful expEPSS 0.1%CVE-2025-66325MEDIUMPermission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%CVE-2025-58294MEDIUMPermission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58315MEDIUMPermission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58282LOWPermission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58285MEDIUMPermission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58276MEDIUMPermission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availabilitEPSS 0.1%