Falhas do tipo CWE-862

9.272 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2022-44435—In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44424MEDIUMIn music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exeEPSS 0.1%CVE-2025-48549HIGHIn multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2024-0037LOWIn applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission cEPSS 0.1%CVE-2022-44436MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44437MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44439MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2024-34719HIGHIn multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege EPSS 0.1%CVE-2022-48384HIGHIn srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2025-36192MEDIUMMissing Authorization with the DS8900F and DS8A00 Hardware Management ConsoleEPSS 0.1%CVE-2022-20544MEDIUMIn onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a missing permission chEPSS 0.1%CVE-2026-47580HIGHNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization isEPSS 0.1%CVE-2022-20536LOWIn registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. ThiEPSS 0.1%CVE-2022-20537LOWIn createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missinEPSS 0.1%CVE-2022-20533LOWIn getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missing permission check. EPSS 0.1%CVE-2026-47493HIGHNVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU reEPSS 0.1%CVE-2025-5317MEDIUMImproper access restriction to critical folder in Bitdefender Endpoint Security Tools for MacEPSS 0.1%CVE-2024-43087HIGHIn getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in tEPSS 0.1%CVE-2022-48383HIGH.In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioEPSS 0.1%CVE-2026-47492MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper acceEPSS 0.1%