Falhas do tipo CWE-862

7.173 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-53818MEDIUMOpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP LoopbackEPSS 0.1%CVE-2023-42736HIGHIn telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executEPSS 0.1%CVE-2023-42747HIGHIn camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executiEPSS 0.1%CVE-2023-42740HIGHIn telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead tEPSS 0.1%CVE-2023-42706MEDIUMIn firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead EPSS 0.1%CVE-2022-47361HIGHIn firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges EPSS 0.1%CVE-2023-42698MEDIUMIn omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to EPSS 0.1%CVE-2026-53820MEDIUMOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session SpawnEPSS 0.1%CVE-2025-48634HIGHIn relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to locEPSS 0.1%CVE-2022-44421MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local In wlan driver, information disclosure.EPSS 0.1%CVE-2026-0024MEDIUMIn isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missinEPSS 0.1%CVE-2022-39119—In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution priviEPSS 0.1%CVE-2025-48640HIGHIn multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to reEPSS 0.1%CVE-2018-9406MEDIUMIn NlpService, there is a possible way to obtain location information due to a missing permission check. This could lead to local escalationEPSS 0.1%CVE-2023-35677—In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could leaEPSS 0.1%CVE-2026-53850MEDIUMOpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus CommandEPSS 0.1%CVE-2025-11791MEDIUMSensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis CybEPSS 0.1%CVE-2026-33776MEDIUMJunos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive informationEPSS 0.1%CVE-2022-42777HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-39093HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%