Falhas do tipo CWE-862

7.087 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2022-48447MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2025-26440HIGHIn multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This EPSS 0.1%CVE-2022-44436MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44434MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44422MEDIUMIn music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exeEPSS 0.1%CVE-2022-44424MEDIUMIn music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exeEPSS 0.1%CVE-2023-48339MEDIUMIn jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privilegeEPSS 0.1%CVE-2023-42655MEDIUMIn sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2023-40105MEDIUMIn backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. ThisEPSS 0.1%CVE-2022-39115MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2023-20726LOWIn mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with noEPSS 0.1%CVE-2022-48448MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2025-48547HIGHIn multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation EPSS 0.1%CVE-2024-40652HIGHIn onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a mEPSS 0.1%CVE-2025-32319MEDIUMIn ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions EPSS 0.1%CVE-2023-38460HIGHIn vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2023-38464HIGHIn vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2025-0076LOWIn multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead toEPSS 0.1%CVE-2023-20826MEDIUMIn cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with nEPSS 0.1%