Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2022-45552—An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive infEPSS 0.7%CVE-2024-34455HIGHBuildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2.EPSS 0.7%CVE-2024-22409HIGHDefault Privileges allow for high level operations for low privileged users in datahubEPSS 0.7%CVE-2021-23166HIGHA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and wEPSS 0.6%CVE-2021-3187HIGHAn issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges bEPSS 0.6%CVE-2024-5967LOWKeycloak: leak of configured ldap bind credentials through the keycloak admin consoleEPSS 0.6%CVE-2025-24891CRITICALDumb Drop has an arbitrary file overwrite and path traversal for root shellEPSS 0.6%CVE-2022-46382HIGHRackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure PermissiEPSS 0.6%CVE-2022-42130MEDIUMThe Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3EPSS 0.6%CVE-2025-49144HIGHNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search PathEPSS 0.6%CVE-2021-4297MEDIUMtrampgeek jobe Restapi.php runs_post Privilege EscalationEPSS 0.6%CVE-2024-11088MEDIUMSimple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized ActorEPSS 0.6%CVE-2025-49843LOWconda-smithy Has Incorrect Default File PermissionsEPSS 0.6%CVE-2023-31116CRITICALAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An incorrect default permission can cause uninteEPSS 0.6%CVE-2025-30706HIGHVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.EPSS 0.6%CVE-2025-27154HIGHSpotipy's cache file, containing spotify auth token, is created with overly broad permissionsEPSS 0.6%CVE-2022-22518MEDIUMA bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.EPSS 0.6%CVE-2024-55225CRITICALAn issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including AdministratorEPSS 0.6%CVE-2020-13541CRITICALAn exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directoryEPSS 0.6%CVE-2023-43984—Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information froEPSS 0.6%