Fallos del tipo CWE-266

1300 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2026-39773CRITICALWordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2026-11519MEDIUMSourceCodester Inventory System Account Creation users_handler.php improper authorizationEPSS 0.3%CVE-2026-68568MEDIUMWordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2025-13114MEDIUMmacrozheng mall-swarm attr updateAttr improper authorizationEPSS 0.3%CVE-2025-14089MEDIUMHimool ERP AdminActionViewSet update_account improper authorizationEPSS 0.3%CVE-2025-14088MEDIUMketr JEPaaS load improper authorizationEPSS 0.3%CVE-2020-1705HIGHA vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modificationEPSS 0.3%CVE-2026-116108MEDIUMopenbq-org OpenBB Local API Server api_settings.py access controlEPSS 0.3%CVE-2026-10215MEDIUMDolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationEPSS 0.3%CVE-2026-1964MEDIUMWeKan REST Endpoint boards.js BoardTitleRESTBleed access controlEPSS 0.3%CVE-2026-27668HIGHA vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators aEPSS 0.3%CVE-2025-13118MEDIUMmacrozheng mall-swarm paySuccess improper authorizationEPSS 0.3%CVE-2026-7292MEDIUMo2oa NodeAgent NodeAgent.java syncFile improper authorizationEPSS 0.3%CVE-2019-19346HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before tEPSS 0.3%CVE-2019-19348HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the EPSS 0.3%CVE-2024-49348MEDIUMIBM Cloud Pak for Business Automation incorrect privilege assignmentEPSS 0.3%CVE-2026-103534MEDIUMDavid-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access controlEPSS 0.3%CVE-2026-2849MEDIUMyeqifu warehouse Cache Sync CacheController.java syncCache access controlEPSS 0.3%CVE-2020-1742—An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to theEPSS 0.3%CVE-2026-103470CRITICALIn Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalateEPSS 0.3%