Fallos del tipo CWE-266

1170 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2026-53862LOWOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope WideningEPSS 0.1%CVE-2026-49413HIGHFlaw in Linuxulator execution of setugid binariesEPSS 0.1%CVE-2025-42992MEDIUMMultiple Privilege Escalation Vulnerabilities in SAPCAREPSS 0.1%CVE-2026-22078HIGHO+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.EPSS 0.1%CVE-2025-58322HIGHNAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrarEPSS 0.1%CVE-2024-0085MEDIUMCVEEPSS 0.1%CVE-2025-48911HIGHVulnerability of improper permission assignment in the note sharing module Impact: Successful exploitation of this vulnerability may affect EPSS 0.1%CVE-2025-36007HIGHIBM QRadar SIEM incorrect privilege assignmentEPSS 0.1%CVE-2024-31315MEDIUMIn multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notificatEPSS 0.1%CVE-2025-36613LOWSupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect PriEPSS 0.1%CVE-2025-68420HIGHPrivilege Escalation in Comarch ERP OptimaEPSS 0.1%CVE-2025-38738MEDIUMSupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in theEPSS 0.1%CVE-2024-32009HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a loEPSS 0.1%CVE-2026-12217HIGHDVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges managementEPSS 0.1%CVE-2025-36612MEDIUMSupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attEPSS 0.1%CVE-2026-12201MEDIUMIObit Malware Fighter DLL permissionEPSS 0.1%CVE-2025-43914HIGHDell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release versionEPSS 0.1%CVE-2025-26425MEDIUMIn multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This couEPSS 0.1%CVE-2026-20110MEDIUMA vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) conditioEPSS 0.1%CVE-2025-48526MEDIUMIn createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profEPSS 0.1%