Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2025-15336MEDIUMTanium addressed an incorrect default permissions vulnerability in Performance.EPSS 0.3%CVE-2025-15339MEDIUMTanium addressed an incorrect default permissions vulnerability in Discover.EPSS 0.3%CVE-2024-49504HIGHgrub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted ImagesEPSS 0.3%CVE-2022-29483HIGHe-Design - Multiple vulnerabilitiesEPSS 0.3%CVE-2026-59119HIGHPowerShell Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-1488HIGHUnbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalationEPSS 0.3%CVE-2026-39875HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS TahoEPSS 0.3%CVE-2021-3981—A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non priviEPSS 0.3%CVE-2023-52379HIGHPermission control vulnerability in the calendarProvider module.Successful exploitation of this vulnerability may affect service confidentiaEPSS 0.3%CVE-2021-31998MEDIUMinn: %post calls user owned file allowing local privilege escalation to rootEPSS 0.3%CVE-2025-15343MEDIUMTanium addressed an incorrect default permissions vulnerability in Enforce.EPSS 0.3%CVE-2025-15341MEDIUMTanium addressed an incorrect default permissions vulnerability in Benchmark.EPSS 0.3%CVE-2025-15340MEDIUMTanium addressed an incorrect default permissions vulnerability in Comply.EPSS 0.3%CVE-2024-36063HIGHThe Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to placeEPSS 0.3%CVE-2021-47852HIGHRockstar Service - Insecure File PermissionsEPSS 0.3%CVE-2018-9467CRITICALIn the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect secuEPSS 0.3%CVE-2020-8903HIGHPriviged Escalation in Google Cloud Platform's Guest-OSLoginEPSS 0.3%CVE-2022-2735—A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communicatioEPSS 0.3%CVE-2021-21911HIGHA privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2EPSS 0.3%CVE-2021-21910HIGHA privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2EPSS 0.3%