Weaknesses of type CWE-653

95 results

Falta de isolamento entre funcionalidades com privilégios diferentes

O software não separa adequadamente recursos, processos ou funcionalidades que deveriam exigir níveis distintos de permissão. Isso permite que um atacante com privilégios baixos acesse ou manipule operações que deveriam estar restritas a administradores ou usuários com privilégios elevados, contornando controles de acesso.

Example

Uma aplicação web permite que um usuário comum modifique configurações globais do sistema simplesmente alterando parâmetros na URL (ex: /admin/settings?role=admin), porque o backend não valida se o usuário autenticado tem permissão de administrador para aquela ação. O código trata todos os usuários da mesma forma.

How to mitigate

Implemente validação rigorosa de permissões em cada operação sensível: verifique o nível de privilégio do usuário antes de executar ações administrativas ou críticas. Use padrões como controle de acesso baseado em papéis (RBAC) e garanta que recursos isolados (arquivos, APIs, bancos de dados) sejam acessíveis apenas conforme a política de segurança define.

CVE-2026-15738MEDIUMCross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer ControllerEPSS 0.6%CVE-2026-119408HIGHn8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function NodesEPSS 0.6%CVE-2024-8118MEDIUMGrafana alerting wrong permission on datasource rule write endpointEPSS 0.6%CVE-2024-43803MEDIUMBMO can expose particularly named secrets from other namespaces via BMH CRDEPSS 0.6%CVE-2025-24986MEDIUMAzure Promptflow Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-114087CRITICALTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsEPSS 0.5%CVE-2026-4692CRITICALSandbox escape in the Responsive Design Mode componentEPSS 0.5%CVE-2023-1636MEDIUMIncomplete container isolationEPSS 0.5%CVE-2024-53855LOWUser can view tickets from organizations they're not apart of in centurion_erpEPSS 0.5%CVE-2025-4083CRITICALProcess isolation bypass using "javascript:" URI links in cross-origin framesEPSS 0.5%CVE-2026-109441MEDIUMLangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker BridgeEPSS 0.4%CVE-2026-4282HIGHKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawEPSS 0.4%CVE-2026-108263CRITICALAstron Agent: Unsandboxed code-node leads to cross-tenant RCEEPSS 0.4%CVE-2025-3086MEDIUMUser in anonymous role could create and delete viewsEPSS 0.4%CVE-2026-115517MEDIUMUnrestricted network access between execution contexts in KNIME Business HubEPSS 0.4%CVE-2024-47520HIGHA user with advanced report application access rights can perform actions for which they are not authorizedEPSS 0.4%CVE-2024-55456MEDIUMlunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cellEPSS 0.4%CVE-2026-57135HIGHPraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsEPSS 0.4%CVE-2024-49373MEDIUMCenturion ERP user can view projects from organizations they're not apart ofEPSS 0.4%CVE-2026-12295CRITICALSandbox escape in the DOM: Navigation componentEPSS 0.4%