Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2026-47134MEDIUMClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policyEPSS 0.2%CVE-2025-40672HIGHPrivilege Escalation in Panloader.exeEPSS 0.2%CVE-2026-26101HIGHIncorrect Permission Assignment for Critical Resource in Owl opdsEPSS 0.2%CVE-2026-26102HIGHIncorrect Permission Assignment for Critical Resource in Owl opdsEPSS 0.2%CVE-2025-62688MEDIUMAutomationDirect Productivity Suite Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2025-64699HIGHAn incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privilEPSS 0.2%CVE-2026-54447HIGHgarminconnect: Insecure Permission Assignment for Garmin OAuth Token StoreEPSS 0.2%CVE-2023-33251MEDIUMWhen Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has toEPSS 0.2%CVE-2022-43309MEDIUMSupermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.EPSS 0.2%CVE-2024-49385MEDIUMSensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) beforEPSS 0.1%CVE-2026-65065MEDIUMData::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2025-0758MEDIUMHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical ResourceEPSS 0.1%CVE-2026-14478HIGHIncorrect Permission Assignment in Autodesk Installer Named PipesEPSS 0.1%CVE-2026-41288HIGHWatchGuard Agent on Windows Privilege Escalation VulnerabilityEPSS 0.1%CVE-2026-33430HIGHBriefcase: Windows MSI Installer Privilege Escalation via Insecure Directory PermissionsEPSS 0.1%CVE-2026-80112HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sysEPSS 0.1%CVE-2025-23403HIGHA vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do nEPSS 0.1%CVE-2023-38640MEDIUMA vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific fiEPSS 0.1%CVE-2026-78604HIGHIncorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEMEPSS 0.1%CVE-2026-48790MEDIUMturso-cli persists Turso platform JWT with world-readable (0o644) file permissionsEPSS 0.1%