Falhas do tipo CWE-862

7.176 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2025-46586MEDIUMPermission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2023-21001HIGHIn onContextItemSelected of NetworkProviderSettings.java, there is a possible way for users to change the Wi-Fi settings of other users due EPSS 0.1%CVE-2022-47358MEDIUMIn log service, there is a missing permission check. This could lead to local denial of service in log service.EPSS 0.1%CVE-2022-47490MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2022-47481MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2022-47359MEDIUMIn log service, there is a missing permission check. This could lead to local denial of service in log service.EPSS 0.1%CVE-2023-21021HIGHIn isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settingEPSS 0.1%CVE-2022-47482MEDIUMIn telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additionaEPSS 0.1%CVE-2022-48379MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution priEPSS 0.1%CVE-2022-48376MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution priEPSS 0.1%CVE-2022-48377MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution priEPSS 0.1%CVE-2022-47360MEDIUMIn log service, there is a missing permission check. This could lead to local denial of service in log service.EPSS 0.1%CVE-2022-47493MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2022-47492MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2023-30864HIGHIn Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional eEPSS 0.1%CVE-2023-21029MEDIUMIn register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usageEPSS 0.1%CVE-2023-30863HIGHIn Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional eEPSS 0.1%CVE-2023-30865MEDIUMIn dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileEPSS 0.1%CVE-2023-30914MEDIUMIn email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privilegEPSS 0.1%CVE-2023-30866MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%