Falhas do tipo CWE-862

7.094 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2023-38460HIGHIn vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2025-48524MEDIUMIn isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local dEPSS 0.1%CVE-2023-20826MEDIUMIn cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with nEPSS 0.1%CVE-2025-0076LOWIn multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead toEPSS 0.1%CVE-2025-48617HIGHIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to lEPSS 0.1%CVE-2025-48604MEDIUMIn multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local iEPSS 0.1%CVE-2018-9382HIGHIn multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing pEPSS 0.1%CVE-2025-22439HIGHIn onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing perEPSS 0.1%CVE-2023-52352MEDIUMIn Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execEPSS 0.1%CVE-2025-26450HIGHIn onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defaEPSS 0.1%CVE-2025-22414HIGHIn FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This coulEPSS 0.1%CVE-2026-26103HIGHUdisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus apiEPSS 0.1%CVE-2025-48599HIGHIn multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permissioEPSS 0.1%CVE-2026-26104MEDIUMUdisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus apiEPSS 0.1%CVE-2025-26437MEDIUMIn CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missingEPSS 0.1%CVE-2025-26445MEDIUMIn offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead tEPSS 0.1%CVE-2024-0028MEDIUMIn Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could EPSS 0.1%CVE-2026-0145LOWIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2025-26418HIGHIn setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toEPSS 0.1%