Fallos del tipo CWE-266

1300 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2019-19352—An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4.EPSS 0.3%CVE-2026-108795MEDIUMZKTeco BioTime System Settings API systemSettings access controlEPSS 0.3%CVE-2026-2852MEDIUMyeqifu warehouse Sales Endpoint SalesController.java deleteSales access controlEPSS 0.3%CVE-2019-19351HIGHAn insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the EPSS 0.3%CVE-2026-4013MEDIUMSourceCodester Web-based Pharmacy Product Management System add_admin.php improper authorizationEPSS 0.3%CVE-2025-12103MEDIUMOpenshift-ai: trusty ai grants all authenticated users to list pods in any namespaceEPSS 0.3%CVE-2026-11466MEDIUMzilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlEPSS 0.3%CVE-2026-6634MEDIUMusememos UpdateInstanceSetting App.tsx memos_access_token improper authorizationEPSS 0.3%CVE-2025-13443MEDIUMmacrozheng mall delete access controlEPSS 0.3%CVE-2026-9376MEDIUMJPress UCenter Article Submission Endpoint doWriteSave improper authorizationEPSS 0.3%CVE-2026-84807MEDIUMKimai before 2.65.0 Authentication Bypass via Team CreationEPSS 0.3%CVE-2025-2397MEDIUMChina Mobile P22g-CIac Telnet Service improper authorizationEPSS 0.3%CVE-2020-10695—An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can EPSS 0.3%CVE-2025-2557MEDIUMAudi UTR Dashcam Command API access controlEPSS 0.2%CVE-2025-50691MEDIUMMCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is storedEPSS 0.2%CVE-2026-35062HIGHiControl SOAP vulnerabilityEPSS 0.2%CVE-2026-96763MEDIUMkvcache-ai mooncake MountSegment Request Processing segment.cpp access controlEPSS 0.2%CVE-2025-5175MEDIUMerdogant pypickle pypickle.py save improper authorizationEPSS 0.2%CVE-2026-26053MEDIUMAn Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileEPSS 0.2%CVE-2023-49647HIGHZoom Desktop Client for Windows - Improper Access ControlEPSS 0.2%