Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-32915MEDIUMSensitive data exposed during automatic agent updatesEPSS 0.1%CVE-2026-53856MEDIUMOpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.jsonEPSS 0.1%CVE-2025-61969HIGHIncorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resultiEPSS 0.1%CVE-2025-40572MEDIUMA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assEPSS 0.1%CVE-2024-47808HIGHA vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that doesEPSS 0.1%CVE-2025-27688HIGHDell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exEPSS 0.1%CVE-2026-49811HIGHDell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A lEPSS 0.1%CVE-2025-30063CRITICALExcessive permissions on configuration files containing database logins and passwordsEPSS 0.1%CVE-2025-2759HIGHGStreamer Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2024-11584MEDIUMcloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, EPSS 0.1%CVE-2026-22280MEDIUMDell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starEPSS 0.1%CVE-2023-53949HIGHAspEmail 5.6.0.2 Local Privilege Escalation via Binary Permission VulnerabilityEPSS 0.1%CVE-2026-2915MEDIUMHP System Event Utility – Denial of ServiceEPSS 0.1%CVE-2025-43470MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. A standard user may be able to viewEPSS 0.1%CVE-2025-59373HIGHA local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when aEPSS 0.1%CVE-2025-59961MEDIUMJunos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writableEPSS 0.1%CVE-2026-80054MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Incorrect PermissEPSS 0.1%CVE-2025-14604MEDIUMThe following vulnerabilities, which may affect IBM Storage Scale when a directory has a specific ACL composition and could lead to improper execute permissions, have been remediated in Storage Scale versions 5.2.3.6 and 6.0.0.2EPSS 0.1%CVE-2024-10209HIGHIncorrect Permission Assignment in APROL file systemEPSS 0.1%CVE-2026-68490HIGHIncorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.EPSS 0.1%