Falhas do tipo CWE-862

9.287 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-13159MEDIUMReal Estate Papi <= 1.0.5 - Subscriber+ Plugin InstallationEPSS 0.1%CVE-2023-42740HIGHIn telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead tEPSS 0.1%CVE-2023-42747HIGHIn camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executiEPSS 0.1%CVE-2023-42736HIGHIn telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executEPSS 0.1%CVE-2026-0024MEDIUMIn isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missinEPSS 0.1%CVE-2023-42698MEDIUMIn omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to EPSS 0.1%CVE-2023-42706MEDIUMIn firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead EPSS 0.1%CVE-2022-47361HIGHIn firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges EPSS 0.1%CVE-2022-44421MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local In wlan driver, information disclosure.EPSS 0.1%CVE-2025-48640HIGHIn multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to reEPSS 0.1%CVE-2018-9406MEDIUMIn NlpService, there is a possible way to obtain location information due to a missing permission check. This could lead to local escalationEPSS 0.1%CVE-2022-20450HIGHIn restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission cEPSS 0.1%CVE-2026-106340MEDIUMMissing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitiEPSS 0.1%CVE-2026-91717MEDIUMMissing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive informatEPSS 0.1%CVE-2026-89121MEDIUMMissing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)EPSS 0.1%CVE-2026-0198MEDIUMIn is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local informationEPSS 0.1%CVE-2025-48591MEDIUMIn multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local iEPSS 0.1%CVE-2022-48249HIGHIn audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioEPSS 0.1%CVE-2022-48245HIGHIn audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioEPSS 0.1%CVE-2026-93832MEDIUMA component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions fEPSS 0.1%