Weaknesses of type CWE-281

225 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2026-24194HIGHNVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission handliEPSS 0.2%CVE-2025-24791MEDIUMsnowflake-connector-nodejs has incorrect validation of temporary credential cache file permissionsEPSS 0.1%CVE-2022-26024MEDIUMImproper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may alloEPSS 0.1%CVE-2023-21464MEDIUMImproper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13 and 12.3.08.2000 in Android 12 allows local attackeEPSS 0.1%CVE-2024-21816MEDIUMBackground task manager has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2026-35361LOWuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux SystemsEPSS 0.1%CVE-2024-22177LOWAudio has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2026-23556CRITICALoxenstored keeps quota related use counts across domain destructionEPSS 0.1%CVE-2026-82964HIGHAvast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sysEPSS 0.1%CVE-2025-43026HIGHHP Support Assistant – Potential Escalation of PrivilegeEPSS 0.1%CVE-2025-37735HIGHImproper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the DefenEPSS 0.1%CVE-2026-35351MEDIUMuutils coreutils mv Silent Ownership Loss in Cross-Device OperationsEPSS 0.1%CVE-2025-27247MEDIUMPasteboard has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2025-26691MEDIUMtelephony_call_manager has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2025-27563LOWsecurity_access_token has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2026-35350MEDIUMuutils coreutils cp Unexpected Privileged Executable Creation with -pEPSS 0.1%CVE-2025-26693LOWsecurity_access_token has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2024-29080MEDIUMPotential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software DrivEPSS 0.1%CVE-2026-25850MEDIUMfilemanagement_storage_service has an improper preservation of permissions vulnerabilityEPSS 0.1%CVE-2025-69875HIGHA vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore pEPSS 0.1%