Fallos del tipo CWE-266

1170 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2024-46511HIGHLoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrEPSS 0.2%CVE-2024-41139HIGHIncorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PCEPSS 0.2%CVE-2024-20389HIGHA vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, loEPSS 0.2%CVE-2026-53847MEDIUMOpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write ScopeEPSS 0.2%CVE-2023-30680HIGHImproper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege.EPSS 0.2%CVE-2025-41255HIGHCyberduck and Mountain Duck - Improper Certificate Store HandlingEPSS 0.2%CVE-2024-13206HIGHREVE Antivirus reveinstall default permissionEPSS 0.2%CVE-2024-36587HIGHInsecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwritingEPSS 0.2%CVE-2024-35122LOWIBM i denial of serviceEPSS 0.2%CVE-2026-67846HIGHBerkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issEPSS 0.2%CVE-2023-30691HIGHParcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation.EPSS 0.2%CVE-2025-2954MEDIUMmannaandpoem OpenManus File file_saver.py execute access controlEPSS 0.2%CVE-2026-19195HIGHV-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access controlEPSS 0.2%CVE-2024-23976MEDIUMBIG-IP Appliance mode iAppsLX vulnerabilityEPSS 0.2%CVE-2025-65842MEDIUMThe Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The serviceEPSS 0.2%CVE-2026-19193HIGHJiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access controlEPSS 0.2%CVE-2024-55542MEDIUMLocal privilege escalation due to excessive permissions assigned to Tray Monitor service. The following products are affected: Acronis CyberEPSS 0.2%CVE-2025-0504MEDIUMBlack Duck SCA Project Privilege EscalationEPSS 0.2%CVE-2024-49561HIGHDell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Incorrect Privilege Assignment vulnerabilitEPSS 0.2%CVE-2025-8758HIGHTRENDnet TEW-822DRE vsftpd least privilege violationEPSS 0.2%