Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2026-28586LOWIn multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to loEPSS 0.1%CVE-2024-23713HIGHIn migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to impropEPSS 0.1%CVE-2024-34743HIGHIn setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could leaEPSS 0.1%CVE-2025-6182HIGHRoot Certificate InjectionEPSS 0.1%CVE-2024-27233HIGHIn ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to local escalation of EPSS 0.1%CVE-2024-38487HIGHapi-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintendEPSS 0.1%CVE-2024-29784HIGHIn prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escaEPSS 0.1%CVE-2026-11103HIGHInappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level prEPSS 0.1%CVE-2024-27224HIGHIn strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of priviEPSS 0.1%CVE-2026-11276MEDIUMInappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass discEPSS 0.1%CVE-2026-16923HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2024-27210HIGHIn policy_check of fvp.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privEPSS 0.1%CVE-2026-0019HIGHIn SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation oEPSS 0.1%CVE-2024-27222HIGHIn onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GREPSS 0.1%CVE-2024-40657HIGHIn addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused depuEPSS 0.1%CVE-2024-32899HIGHIn gpu_pm_power_off_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a race condition. This could EPSS 0.1%CVE-2024-25990MEDIUMIn pktproc_perftest_gen_rx_packet_sktbuf_mode of link_rx_pktproc.c, there is a possible out of bounds write due to a race condition. This coEPSS 0.1%CVE-2026-0086MEDIUMIn onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could leaEPSS 0.1%CVE-2024-49742HIGHIn onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings dueEPSS 0.1%CVE-2026-0179MEDIUMIn Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege witEPSS 0.1%