Falhas do tipo CWE-862

7.177 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2023-21141—In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. This could lead EPSS 0.1%CVE-2022-44439MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44438MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-48391MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2022-44436MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2023-40105MEDIUMIn backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. ThisEPSS 0.1%CVE-2023-42655MEDIUMIn sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2023-48339MEDIUMIn jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privilegeEPSS 0.1%CVE-2023-20726LOWIn mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with noEPSS 0.1%CVE-2022-48448MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution EPSS 0.1%CVE-2022-39115MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2025-48547HIGHIn multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation EPSS 0.1%CVE-2024-40652HIGHIn onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a mEPSS 0.1%CVE-2025-32319MEDIUMIn ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions EPSS 0.1%CVE-2017-13316HIGHIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toEPSS 0.1%CVE-2023-38460HIGHIn vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2023-38464HIGHIn vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2025-48524MEDIUMIn isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local dEPSS 0.1%CVE-2025-0076LOWIn multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead toEPSS 0.1%CVE-2023-20826MEDIUMIn cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with nEPSS 0.1%