Falhas do tipo CWE-862

9.294 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-0145MEDIUMIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no EPSS 0.1%CVE-2026-45524HIGHIn isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escaEPSS 0.1%CVE-2024-0028MEDIUMIn Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could EPSS 0.1%CVE-2026-0192MEDIUMIn Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privileEPSS 0.1%CVE-2025-26418HIGHIn setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account toEPSS 0.1%CVE-2025-48575HIGHIn multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead toEPSS 0.1%CVE-2026-0133HIGHIn smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permissiEPSS 0.1%CVE-2026-0158MEDIUMIn Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disEPSS 0.1%CVE-2026-0054LOWIn isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission cheEPSS 0.1%CVE-2026-0057LOWIn Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission EPSS 0.1%CVE-2026-25267HIGHMissing Authorization in CoreEPSS 0.1%CVE-2026-107426HIGHWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerabilityEPSS —CVE-2026-110622HIGHPapermerge Core through 3.5.3 Missing Authorization in Page Management and OCR EndpointsEPSS —CVE-2026-107417MEDIUMWordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerabilityEPSS —CVE-2026-107795HIGHImproper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management APIEPSS —CVE-2026-110888MEDIUMWordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerabilityEPSS —CVE-2026-111353MEDIUMPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload EndpointsEPSS —CVE-2026-46708MEDIUMEspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to recordEPSS —CVE-2026-97712HIGHNexus Repository 3 - Privilege Escalation via Role ManagementEPSS —CVE-2026-110623HIGHPapermerge Core through 3.5.3 Missing Authorization in Shared Nodes APIEPSS —