Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-23495MEDIUMIncorrect default permissions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to poteEPSS 0.1%CVE-2026-9633HIGHRedundancy Module Configuration Tool - Multiple VulnerabilitiesEPSS 0.1%CVE-2022-20475HIGHIn test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused depEPSS 0.1%CVE-2025-53811MEDIUMTCC Bypass via misconfigured Node fuses in Mosh-ProEPSS 0.1%CVE-2025-53813MEDIUMTCC Bypass via misconfigured Node fuses in NozbeEPSS 0.1%CVE-2025-43725HIGHDell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerabiEPSS 0.1%CVE-2025-32091HIGHIncorrect default permissions in some firmware for the Intel(R) Arc(TM) B-series GPUs within Ring 1: Device Drivers may allow an escalation EPSS 0.1%CVE-2025-13131HIGHSonarr Service Sonarr.Console.exe default permissionEPSS 0.1%CVE-2024-27461MEDIUMIncorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of sEPSS 0.1%CVE-2024-13972HIGHA vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a loEPSS 0.1%CVE-2024-34012MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bEPSS 0.1%CVE-2025-55111MEDIUMBMC Control-M/Agent insecure default file permissionsEPSS 0.1%CVE-2026-24063HIGHWorld-writable uninstall script executed as root in Arturia Software CenterEPSS 0.1%CVE-2025-36857LOWRapid7 Appspider Broken Access Control VulnerabilityEPSS 0.1%CVE-2024-25958MEDIUMDell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. A local authenticated EPSS 0.1%CVE-2025-10231HIGHN-central Incorrect Default Permissions could lead to Privilege EscalationEPSS 0.1%CVE-2025-32749MEDIUMDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticateEPSS 0.1%CVE-2025-48959MEDIUMLocal privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindowsEPSS 0.1%CVE-2025-64724MEDIUMArduino IDE for macOS has Insecure File PermissionsEPSS 0.1%CVE-2025-53945HIGHapko has incorrect permission (0666) in /etc/ld.so.cache and other filesEPSS 0.1%