Weaknesses of type CWE-280

170 results

Tratamento inadequado de permissões ou privilégios insuficientes

Ocorre quando uma aplicação não valida ou não rejeita adequadamente requisições de usuários que carecem de permissões necessárias para executar uma ação. Em vez de negar o acesso, o sistema permite a operação, expõe informações sensíveis ou executa funções críticas sem verificar direitos. O risco é perda de confidencialidade, integridade ou disponibilidade dos dados.

Example

Uma API REST que deleta registros de usuários verifica apenas se o token JWT é válido, mas não confirma se o usuário autenticado tem permissão 'admin' para deletar. Qualquer usuário logado consegue remover dados de outros usuários ou do sistema.

How to mitigate

Implemente verificações de autorização granulares em cada endpoint ou função sensível, validando não apenas autenticação, mas o nível de privilégio necessário. Use o padrão de controle de acesso baseado em papéis (RBAC) ou atributos (ABAC) e teste permissões antes de executar operações críticas.

CVE-2026-0047HIGHIn dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permisEPSS 0.1%CVE-2025-25179HIGHGPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memoryEPSS 0.1%CVE-2024-51459HIGHIBM InfoSphere Server Information command executionEPSS 0.1%CVE-2026-64701HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious aEPSS 0.1%CVE-2024-8315MEDIUMImproper Handling of Insufficient Permissions or Privileges in B&R APROLEPSS 0.1%CVE-2022-22292HIGHUnprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.EPSS 0.1%CVE-2025-46584HIGHVulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerabilitEPSS 0.1%CVE-2026-21736MEDIUMGPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabledEPSS 0.1%CVE-2026-46054HIGHselinux: fix overlayfs mmap() and mprotect() access checksEPSS 0.1%CVE-2025-58770HIGHTCG2 TPM RT Not Locked IssueEPSS 0.1%CVE-2022-39912MEDIUMImproper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows EPSS 0.1%CVE-2026-84631HIGHThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root prEPSS 0.1%CVE-2025-31173HIGHMemory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect serEPSS 0.1%CVE-2025-31172HIGHMemory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect serEPSS 0.1%CVE-2026-86917HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS TahoeEPSS 0.1%CVE-2022-30725MEDIUMBroadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of BluetEPSS 0.1%CVE-2022-30724MEDIUMBroadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of BEPSS 0.1%CVE-2022-30723MEDIUMBroadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice functEPSS 0.1%CVE-2025-27521MEDIUMVulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affecEPSS 0.1%CVE-2025-45376HIGHDell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerabiliEPSS 0.1%