Weaknesses of type CWE-281

225 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2021-20263—A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capabilitEPSS 0.4%CVE-2023-22738MEDIUMImproper Preservation of Permissions in vantage6EPSS 0.4%CVE-2024-56317HIGHIn Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then atteEPSS 0.4%CVE-2026-39828MEDIUMInvoking bypass of certificate restrictions in golang.org/x/crypto/sshEPSS 0.4%CVE-2025-22620MEDIUMgix-worktree-state nonexclusive checkout sets executable files world-writableEPSS 0.4%CVE-2026-34744MEDIUMMantisBT authorization bypass allows continued access to self-uploaded attachments on private issuesEPSS 0.4%CVE-2024-50928MEDIUMInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devicesEPSS 0.4%CVE-2024-43784MEDIUMRe-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletionEPSS 0.4%CVE-2025-32696NONE"reupload-own" restriction can be bypassed by reverting fileEPSS 0.4%CVE-2023-28642MEDIUMAppArmor bypass with symlinked /proc in runcEPSS 0.3%CVE-2024-40800HIGHAn input validation issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macEPSS 0.3%CVE-2024-56178MEDIUMAn issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group EPSS 0.3%CVE-2026-61709MEDIUMOpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that userEPSS 0.3%CVE-2023-42231HIGHPat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users byEPSS 0.3%CVE-2022-48295HIGHThe IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (baEPSS 0.3%CVE-2022-48301HIGHThe bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-iEPSS 0.3%CVE-2024-23560MEDIUMHCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type EPSS 0.3%CVE-2023-52542MEDIUMPermission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2023-52373HIGHVulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthEPSS 0.3%CVE-2023-25809MEDIUMrootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runcEPSS 0.3%