Falhas do tipo CWE-862

7.126 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2025-5317MEDIUMImproper access restriction to critical folder in Bitdefender Endpoint Security Tools for MacEPSS 0.1%CVE-2022-38682MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38678MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2026-33632HIGHClearanceKit: opfilter policy bypass via exchangedata and clone operationsEPSS 0.1%CVE-2026-6509HIGHPrivilege Escalation in TUBITAK BILGEM's Pardus UpdateEPSS 0.1%CVE-2026-33631HIGHClearanceKit: opfilter policy bypass via non-open file operationsEPSS 0.1%CVE-2022-47341MEDIUMIn engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privilEPSS 0.1%CVE-2025-48600MEDIUMIn multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local inEPSS 0.1%CVE-2025-48578HIGHIn multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permisEPSS 0.1%CVE-2026-55628MEDIUMImageMagick: Policy Bypass in concatenate operation due to missing checksEPSS 0.1%CVE-2023-21341HIGHIn Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local esEPSS 0.1%CVE-2023-42688HIGHIn wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2023-42694HIGHIn wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2022-39112MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2025-48614MEDIUMIn rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permissEPSS 0.1%CVE-2025-48574HIGHIn validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permiEPSS 0.1%CVE-2023-42681HIGHIn ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution EPSS 0.1%CVE-2022-39113MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2022-39114MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2023-42736HIGHIn telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executEPSS 0.1%