Fallos del tipo CWE-266

1169 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2019-19348HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the EPSS 0.3%CVE-2026-93968MEDIUMaiyiyi121 SxDevOps UserSerializer serializers.py update privileges managementEPSS 0.3%CVE-2025-14052MEDIUMyoulaitech youlai-mall members getMemberById access controlEPSS 0.3%CVE-2024-49348MEDIUMIBM Cloud Pak for Business Automation incorrect privilege assignmentEPSS 0.3%CVE-2026-1892LOWWeKan REST API boards.js setBoardOrgs improper authorizationEPSS 0.3%CVE-2020-1742—An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to theEPSS 0.3%CVE-2026-76999MEDIUMSourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorizationEPSS 0.3%CVE-2019-19352—An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4.EPSS 0.3%CVE-2026-3738MEDIUMSourceCodester Pet Grooming Management Software Financial Report improper authorizationEPSS 0.3%CVE-2026-3737MEDIUMSourceCodester Pet Grooming Management Software User Creation add_user.php improper authorizationEPSS 0.3%CVE-2019-19351HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the EPSS 0.3%CVE-2026-11466MEDIUMzilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlEPSS 0.3%CVE-2026-9376MEDIUMJPress UCenter Article Submission Endpoint doWriteSave improper authorizationEPSS 0.3%CVE-2026-20028MEDIUMCisco Terminal Services Agent Firewall Rules Bypass VulnerabilityEPSS 0.3%CVE-2026-6634MEDIUMusememos UpdateInstanceSetting App.tsx memos_access_token improper authorizationEPSS 0.3%CVE-2026-19928MEDIUMOpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges managementEPSS 0.3%CVE-2026-85401MEDIUMDolibarr Legacy File Manager config.inc.php access controlEPSS 0.3%CVE-2020-10695—An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can EPSS 0.3%CVE-2026-1894MEDIUMWeKan REST API checklistItems.js Checklist REST Bleed improper authorizationEPSS 0.3%CVE-2026-68568MEDIUMWordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerabilityEPSS 0.2%