Weaknesses of type CWE-266

1,175 results

Atribuição incorreta de privilégios

Acontece quando uma aplicação ou sistema concede permissões (privilégios) a um usuário, processo ou recurso de forma errada — atribuindo mais acesso do que deveria ou permitindo operações que não deveriam estar disponíveis. O risco é que um atacante ou usuário sem autorização consiga executar ações críticas, acessar dados sensíveis ou elevar seus privilégios no sistema.

Example

Um aplicativo cria um arquivo de configuração com permissões 0666 (leitura e escrita para todos) quando deveria ser 0600 (apenas dono); ou uma API expõe endpoints administrativos sem verificar se o usuário logado é realmente um admin, permitindo que qualquer pessoa autenticada delete dados ou mude configurações.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC) ou atributos (ABAC), verificando permissões explicitamente antes de cada operação crítica. Defina permissões padrão restritivas (deny-by-default), revise regularmente quem tem acesso a quê, e use ferramentas de análise estática para detectar atribuições de privilégio hardcoded ou inconsistentes no código.

CVE-2025-65807HIGHAn issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.EPSS 0.2%CVE-2025-5791HIGHUsers: `root` appended to group listingsEPSS 0.2%CVE-2026-22268MEDIUMDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attaEPSS 0.2%CVE-2025-42936MEDIUMMissing Authorization check in SAP NetWeaver Application Server for ABAPEPSS 0.2%CVE-2024-47904HIGHA vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All veEPSS 0.2%CVE-2024-20320HIGHA vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) EPSS 0.2%CVE-2024-36534HIGHInsecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service accounEPSS 0.2%CVE-2025-26517MEDIUMCVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)EPSS 0.2%CVE-2024-13248MEDIUMPrivate content - Moderately critical - Access bypass - SA-CONTRIB-2024-012EPSS 0.2%CVE-2025-4228MEDIUMCortex XDR Broker VM: Privilege Escalation (PE) VulnerabilityEPSS 0.2%CVE-2025-41255HIGHCyberduck and Mountain Duck - Improper Certificate Store HandlingEPSS 0.2%CVE-2023-40109HIGHIn createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lEPSS 0.2%CVE-2025-11641LOWTomofun Furbo 360/Furbo Mini Trial Restriction access controlEPSS 0.2%CVE-2024-46511HIGHLoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrEPSS 0.2%CVE-2024-41139HIGHIncorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PCEPSS 0.2%CVE-2026-84716MEDIUMAutomation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnamesEPSS 0.2%CVE-2024-20389HIGHA vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, loEPSS 0.2%CVE-2023-30680HIGHImproper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege.EPSS 0.2%CVE-2026-3796MEDIUMQi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access controlEPSS 0.2%CVE-2024-13206HIGHREVE Antivirus reveinstall default permissionEPSS 0.2%