Falhas do tipo CWE-862

7.124 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2022-38670HIGHIn soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additioEPSS 0.1%CVE-2022-20544MEDIUMIn onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a missing permission chEPSS 0.1%CVE-2022-38669HIGHIn soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additioEPSS 0.1%CVE-2022-20533LOWIn getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missing permission check. EPSS 0.1%CVE-2022-39091HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-20537LOWIn createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missinEPSS 0.1%CVE-2023-21002HIGHIn getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission checEPSS 0.1%CVE-2022-20536LOWIn registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. ThiEPSS 0.1%CVE-2024-5899LOWImproper trust check in Bazel Build intellij pluginEPSS 0.1%CVE-2022-39092HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-39090HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2025-48549HIGHIn multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2021-0641MEDIUMIn getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing peEPSS 0.1%CVE-2022-39101HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-39099HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-39080HIGHIn messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional EPSS 0.1%CVE-2022-39110HIGHIn Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional executiEPSS 0.1%CVE-2022-39096HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-39107HIGHIn Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no adEPSS 0.1%CVE-2022-38698HIGHIn messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional EPSS 0.1%