Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2026-77393HIGHInductive Automation Ignition Incorrect Default PermissionsEPSS 0.5%CVE-2021-36400MEDIUMIn Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.EPSS 0.5%CVE-2019-9579HIGHAn issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have uniEPSS 0.5%CVE-2020-13552HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2020-13555HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2020-13553HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2023-29057HIGHA valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to EPSS 0.5%CVE-2025-15615MEDIUMWazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of ServiceEPSS 0.5%CVE-2024-27171HIGHInsecure permissionsEPSS 0.5%CVE-2020-8024MEDIUMProblematic permissions in hylafax+ packaging allow escalation from uucp to other usersEPSS 0.5%CVE-2026-75166HIGHInsecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/EPSS 0.5%CVE-2020-13551HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installationEPSS 0.5%CVE-2022-43574HIGH"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could alloEPSS 0.5%CVE-2022-37003MEDIUMThe AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation aEPSS 0.5%CVE-2025-30701HIGHVulnerability in the RAS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and EPSS 0.5%CVE-2024-52946HIGHAn issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise theirEPSS 0.5%CVE-2024-44151MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13EPSS 0.5%CVE-2024-45494CRITICALAn issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an internally used sharEPSS 0.5%CVE-2024-53351CRITICALInsecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.EPSS 0.5%CVE-2025-25535CRITICALHTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.EPSS 0.5%