Falhas do tipo CWE-862

9.294 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2023-42655MEDIUMIn sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2025-48599HIGHIn multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permissioEPSS 0.1%CVE-2023-40105MEDIUMIn backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. ThisEPSS 0.1%CVE-2023-48339MEDIUMIn jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privilegeEPSS 0.1%CVE-2025-22439HIGHIn onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing perEPSS 0.1%CVE-2022-48448MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2023-20726LOWIn mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with noEPSS 0.1%CVE-2025-22414HIGHIn FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This coulEPSS 0.1%CVE-2026-18058HIGHThe mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation cEPSS 0.1%CVE-2025-26450HIGHIn onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defaEPSS 0.1%CVE-2024-40652HIGHIn onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a mEPSS 0.1%CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2025-26437MEDIUMIn CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missingEPSS 0.1%CVE-2026-15060MEDIUMsystemd-machined: unprivileged users can terminate arbitrary processesEPSS 0.1%CVE-2025-26445MEDIUMIn offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead tEPSS 0.1%CVE-2026-106367HIGHMissing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineeringEPSS 0.1%CVE-2018-9382HIGHIn multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing pEPSS 0.1%CVE-2025-48617HIGHIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to lEPSS 0.1%CVE-2026-0145MEDIUMIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2026-56952MEDIUMIn platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could EPSS 0.1%