Weaknesses of type CWE-653

95 results

Falta de isolamento entre funcionalidades com privilégios diferentes

O software não separa adequadamente recursos, processos ou funcionalidades que deveriam exigir níveis distintos de permissão. Isso permite que um atacante com privilégios baixos acesse ou manipule operações que deveriam estar restritas a administradores ou usuários com privilégios elevados, contornando controles de acesso.

Example

Uma aplicação web permite que um usuário comum modifique configurações globais do sistema simplesmente alterando parâmetros na URL (ex: /admin/settings?role=admin), porque o backend não valida se o usuário autenticado tem permissão de administrador para aquela ação. O código trata todos os usuários da mesma forma.

How to mitigate

Implemente validação rigorosa de permissões em cada operação sensível: verifique o nível de privilégio do usuário antes de executar ações administrativas ou críticas. Use padrões como controle de acesso baseado em papéis (RBAC) e garanta que recursos isolados (arquivos, APIs, bancos de dados) sejam acessíveis apenas conforme a política de segurança define.

CVE-2026-12297CRITICALSandbox escape due to incorrect boundary conditions in the Networking componentEPSS 0.4%CVE-2026-102125HIGHKiteworks Core Sandbox EscapeEPSS 0.4%CVE-2025-12805HIGHLlama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicyEPSS 0.4%CVE-2026-65635HIGHBoruta dynamic client registration allows creation of over-privileged OAuth clientsEPSS 0.4%CVE-2026-8945HIGHSandbox escape in Firefox and Firefox Focus for AndroidEPSS 0.4%CVE-2025-5476MEDIUMSony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass VulnerabilityEPSS 0.4%CVE-2026-62246HIGHKamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationEPSS 0.4%CVE-2026-120306CRITICALBeta9 build sandbox escape via chroot-only isolationEPSS 0.4%CVE-2024-57721MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.EPSS 0.4%CVE-2024-57723MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.EPSS 0.4%CVE-2024-57720MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.EPSS 0.4%CVE-2024-23683HIGHArtemis Java Test Sandbox InvocationTargetException Subclass EscapeEPSS 0.4%CVE-2024-23682HIGHArtemis Java Test Sandbox Class Loading EscapeEPSS 0.4%CVE-2025-46215MEDIUMAn Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 throuEPSS 0.3%CVE-2025-12695MEDIUMInsecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandboxEPSS 0.3%CVE-2025-26393MEDIUMSolarWinds Service Desk Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-0137MEDIUMNVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted codeEPSS 0.3%CVE-2026-8401CRITICALSandbox escape in the Profile Backup componentEPSS 0.3%CVE-2023-29580MEDIUMyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.EPSS 0.3%CVE-2025-34201HIGHVasion Print (formerly PrinterLogic) Lack of Network Segmentation Between Docker InstancesEPSS 0.3%