Falhas do tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2017-9711MEDIUMPermissions, Privileges, and Access Controls in DataEPSS 0.1%CVE-2025-54608MEDIUMVulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: SuccessEPSS 0.1%CVE-2026-58555MEDIUMPermission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2023-7265MEDIUMPermission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availabilitEPSS 0.1%CVE-2026-58556MEDIUMPermission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49315HIGHDoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49309MEDIUMPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2026-49304MEDIUMPermission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availEPSS 0.1%CVE-2026-41987MEDIUMPermission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availabilityEPSS 0.1%CVE-2026-24920MEDIUMPermission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2023-21641MEDIUMPermissions, Privileges, and Access Controls in DisplayEPSS 0.1%CVE-2026-24931MEDIUMVulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect servEPSS 0.1%CVE-2024-45449MEDIUMAccess permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affectEPSS 0.1%CVE-2026-108788MEDIUMdeepseek-ai deepseek-harness Sandbox spawn sandboxEPSS 0.1%CVE-2025-68967MEDIUMVulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2026-49303MEDIUMPermission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-46587MEDIUMPermission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidEPSS 0.1%CVE-2024-39670MEDIUMPrivilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulnerability will affect EPSS 0.1%CVE-2026-49313MEDIUMPermission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2024-5465MEDIUMFunction vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%