Falhas do tipo CWE-862

9.293 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2025-32319MEDIUMIn ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions EPSS 0.1%CVE-2022-47481MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2022-47483MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2022-47360MEDIUMIn log service, there is a missing permission check. This could lead to local denial of service in log service.EPSS 0.1%CVE-2022-48377MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution priEPSS 0.1%CVE-2023-21001HIGHIn onContextItemSelected of NetworkProviderSettings.java, there is a possible way for users to change the Wi-Fi settings of other users due EPSS 0.1%CVE-2022-48376MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution priEPSS 0.1%CVE-2022-47482MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2023-21021HIGHIn isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settingEPSS 0.1%CVE-2022-47492MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2022-47493MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2022-47358MEDIUMIn log service, there is a missing permission check. This could lead to local denial of service in log service.EPSS 0.1%CVE-2022-47490MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2023-30864HIGHIn Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional eEPSS 0.1%CVE-2023-30863HIGHIn Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional eEPSS 0.1%CVE-2023-21029MEDIUMIn register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usageEPSS 0.1%CVE-2025-48547HIGHIn multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation EPSS 0.1%CVE-2023-30865MEDIUMIn dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileEPSS 0.1%CVE-2022-48378MEDIUMIn engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional executiEPSS 0.1%CVE-2023-30866MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%