Falhas do tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2024-51527MEDIUMPermission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-53186MEDIUMVulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful expEPSS 0.1%CVE-2026-49312MEDIUMPermission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentialEPSS 0.1%CVE-2024-21469HIGHPermissions, Privileges, and Access Control issues in TZ Secure OSEPSS 0.1%CVE-2025-58302HIGHPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2021-25472MEDIUMAn improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrEPSS 0.1%CVE-2026-28541MEDIUMPermission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-66325MEDIUMPermission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%CVE-2025-53177LOWPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2025-58294MEDIUMPermission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58283MEDIUMPermission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58315MEDIUMPermission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58309MEDIUMPermission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availabilEPSS 0.1%CVE-2025-53178MEDIUMPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2025-58284MEDIUMPermission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-54654MEDIUMPermission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-64315MEDIUMConfiguration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data EPSS 0.1%CVE-2025-58282LOWPermission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58285MEDIUMPermission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-66329MEDIUMPermission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.1%