Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2025-64723MEDIUMArduino IDE for macOS has TCC Bypass via Dynamic Library InjectionEPSS 0.1%CVE-2024-6476MEDIUMGee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system priviEPSS 0.1%CVE-2025-24826MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before buiEPSS 0.1%CVE-2026-28717MEDIUMLocal privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) beEPSS 0.1%CVE-2025-1699LOWAn incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.EPSS 0.1%CVE-2025-41658MEDIUMCODESYS Toolkit Exposes Sensitive Files via Default PermissionsEPSS 0.1%CVE-2026-11931MEDIUMInsecure Permissions on Authentication Token Cache File in Kiro IDEEPSS 0.1%CVE-2025-8485HIGHAn improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevEPSS 0.1%CVE-2024-26025MEDIUMIncorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enableEPSS 0.1%CVE-2025-11567HIGHCWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is nEPSS 0.1%CVE-2025-11535HIGHMongoDB Connector for BI installation MSI leave ACLs unset on custom installation directoriesEPSS 0.1%CVE-2024-27134HIGHExcessive directory permissions in MLflow leads to local privilege escalation when using spark_udfEPSS 0.1%CVE-2025-8098HIGHAn improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.EPSS 0.1%CVE-2022-20441HIGHIn navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could leEPSS 0.1%CVE-2025-58097MEDIUMThe installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate fEPSS 0.1%CVE-2025-13155HIGHAn improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code withEPSS 0.1%CVE-2025-13193MEDIUMLibvirt: information disclosure via world-readable vm snapshotsEPSS 0.1%CVE-2026-44469HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2025-53398HIGHThe Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,EPSS 0.1%CVE-2025-22849MEDIUMIncorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4EPSS 0.1%