Weaknesses of type CWE-266

1,172 results

Atribuição incorreta de privilégios

Acontece quando uma aplicação ou sistema concede permissões (privilégios) a um usuário, processo ou recurso de forma errada — atribuindo mais acesso do que deveria ou permitindo operações que não deveriam estar disponíveis. O risco é que um atacante ou usuário sem autorização consiga executar ações críticas, acessar dados sensíveis ou elevar seus privilégios no sistema.

Example

Um aplicativo cria um arquivo de configuração com permissões 0666 (leitura e escrita para todos) quando deveria ser 0600 (apenas dono); ou uma API expõe endpoints administrativos sem verificar se o usuário logado é realmente um admin, permitindo que qualquer pessoa autenticada delete dados ou mude configurações.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC) ou atributos (ABAC), verificando permissões explicitamente antes de cada operação crítica. Defina permissões padrão restritivas (deny-by-default), revise regularmente quem tem acesso a quê, e use ferramentas de análise estática para detectar atribuições de privilégio hardcoded ou inconsistentes no código.

CVE-2020-1705HIGHA vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modificationEPSS 0.3%CVE-2026-10215MEDIUMDolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationEPSS 0.3%CVE-2019-19346HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before tEPSS 0.3%CVE-2019-19348HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the EPSS 0.3%CVE-2024-49348MEDIUMIBM Cloud Pak for Business Automation incorrect privilege assignmentEPSS 0.3%CVE-2025-14052MEDIUMyoulaitech youlai-mall members getMemberById access controlEPSS 0.3%CVE-2020-1742—An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to theEPSS 0.3%CVE-2026-1892LOWWeKan REST API boards.js setBoardOrgs improper authorizationEPSS 0.3%CVE-2019-19352—An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4.EPSS 0.3%CVE-2026-2206MEDIUMWeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access controlEPSS 0.3%CVE-2019-19351HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the EPSS 0.3%CVE-2026-11466MEDIUMzilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlEPSS 0.3%CVE-2026-84807MEDIUMKimai before 2.65.0 Authentication Bypass via Team CreationEPSS 0.3%CVE-2026-1894MEDIUMWeKan REST API checklistItems.js Checklist REST Bleed improper authorizationEPSS 0.3%CVE-2020-10695—An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can EPSS 0.3%CVE-2025-50691MEDIUMMCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is storedEPSS 0.2%CVE-2026-96763MEDIUMkvcache-ai mooncake MountSegment Request Processing segment.cpp access controlEPSS 0.2%CVE-2026-26053MEDIUMAn Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileEPSS 0.2%CVE-2021-1572HIGHConfD CLI Secure Shell Server Privilege Escalation VulnerabilityEPSS 0.2%CVE-2023-49647HIGHZoom Desktop Client for Windows - Improper Access ControlEPSS 0.2%