Falhas do tipo CWE-862
9.288 resultadosFalha de verificação de autorização
A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.
Exemplo
Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.
Como mitigar
Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.
CVE-2022-47471MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47477MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47450MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-47332MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-48371MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional executioEPSS 0.1%CVE-2022-47479MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2025-26440HIGHIn multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This EPSS 0.1%CVE-2022-48370MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional executioEPSS 0.1%CVE-2022-47327MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-47475MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47478MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47333MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2026-28611HIGHIn multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check.EPSS 0.1%CVE-2023-20959HIGHIn AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead toEPSS 0.1%CVE-2023-40654MEDIUMIn FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2022-48375MEDIUMIn contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution pEPSS 0.1%CVE-2022-47481MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2022-47483MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2022-47359MEDIUMIn log service, there is a missing permission check. This could lead to local denial of service in log service.EPSS 0.1%CVE-2022-47482MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%