Weaknesses of type CWE-280

178 results

Tratamento inadequado de permissões ou privilégios insuficientes

Ocorre quando uma aplicação não valida ou não rejeita adequadamente requisições de usuários que carecem de permissões necessárias para executar uma ação. Em vez de negar o acesso, o sistema permite a operação, expõe informações sensíveis ou executa funções críticas sem verificar direitos. O risco é perda de confidencialidade, integridade ou disponibilidade dos dados.

Example

Uma API REST que deleta registros de usuários verifica apenas se o token JWT é válido, mas não confirma se o usuário autenticado tem permissão 'admin' para deletar. Qualquer usuário logado consegue remover dados de outros usuários ou do sistema.

How to mitigate

Implemente verificações de autorização granulares em cada endpoint ou função sensível, validando não apenas autenticação, mas o nível de privilégio necessário. Use o padrão de controle de acesso baseado em papéis (RBAC) ou atributos (ABAC) e teste permissões antes de executar operações críticas.

CVE-2023-28114MEDIUM`cilium-cli` disables etcd authorization for clustermesh clustersEPSS 0.2%CVE-2022-27167HIGHArbitrary File Deletion in ESET products for WindowsEPSS 0.2%CVE-2026-43786HIGHThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26EPSS 0.2%CVE-2026-3322MEDIUMPrivilege escalation via request replaying in Lobster_proEPSS 0.2%CVE-2025-3931HIGHYggdrasil: local privilege escalation in yggdrasilEPSS 0.2%CVE-2023-2480HIGHElevation of Privilege in M-Files Desktop ClientEPSS 0.2%CVE-2026-90462MEDIUMSssd: sssd: fail-open in ldap ppolicy access check allows continued authorizationEPSS 0.2%CVE-2025-58122MEDIUMInsufficient permission validation when configuring notification parametersEPSS 0.2%CVE-2024-27837HIGHA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gaEPSS 0.2%CVE-2026-44199MEDIUMWagtail: Improper permission handling when deleting form submissionsEPSS 0.2%CVE-2023-32489MEDIUM Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially expEPSS 0.2%CVE-2023-43591HIGHImproper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of priEPSS 0.2%CVE-2022-39872MEDIUMImproper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.EPSS 0.2%CVE-2023-25543HIGH Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious userEPSS 0.2%CVE-2026-44198MEDIUMWagtail: Improper permission handling when viewing page historyEPSS 0.2%CVE-2026-20463MEDIUMIn Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malEPSS 0.2%CVE-2025-43527HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may beEPSS 0.2%CVE-2026-80301—Avast sandbox escape via unpreserved COM pathway through Task SchedulerEPSS 0.2%CVE-2023-21421MEDIUMImproper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allowsEPSS 0.2%CVE-2024-32488HIGHIn Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the upEPSS 0.2%