Weaknesses of type CWE-281

225 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2025-7346HIGHAny unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packagesEPSS 0.3%CVE-2026-44832HIGHSnipe-IT: Privilege Escalation via API Permissions AssignmentEPSS 0.3%CVE-2024-39902MEDIUMTuleap's recursive permissions to document manager folder are not properly appliedEPSS 0.3%CVE-2024-50930HIGHAn issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.EPSS 0.3%CVE-2025-27703HIGHPrivilege escalation in the management console of Absolute Secure Access prior to version 13.54EPSS 0.3%CVE-2021-41089LOW`docker cp` allows unexpected chmod of host filesEPSS 0.3%CVE-2023-2993MEDIUMA valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limEPSS 0.3%CVE-2023-32355—A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS VenturEPSS 0.3%CVE-2026-40767HIGHWordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-53994MEDIUMPotential bypass of chat permissions in DiscourseEPSS 0.3%CVE-2022-48296MEDIUMThe SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasEPSS 0.3%CVE-2024-44223MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to aEPSS 0.3%CVE-2024-3545MEDIUMImproper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and DEPSS 0.3%CVE-2024-40824HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, wEPSS 0.3%CVE-2022-31608HIGHNVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabiliEPSS 0.3%CVE-2023-28647MEDIUMApp pin of the iOS app can be bypassed in Nextcloud iOSEPSS 0.3%CVE-2026-4360LOWTarfile.extract() doesn't fully respect filter parameterEPSS 0.3%CVE-2025-21541MEDIUMVulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that aEPSS 0.3%CVE-2024-37649MEDIUMInsecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtEPSS 0.3%CVE-2026-34600MEDIUMJoplin Server delta API returns note content after share access is revokedEPSS 0.3%