Fallos del tipo CWE-266

1300 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2026-12781HIGHEaseUS Partition Master Kernel Driver epmntdrv.sys access controlEPSS 0.2%CVE-2026-19191HIGHStableBit DrivePool DrivePoolService DrivePool.Service.exe permissionEPSS 0.2%CVE-2025-1078MEDIUMAppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorizationEPSS 0.2%CVE-2026-82628CRITICALColorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges managementEPSS 0.2%CVE-2026-82671MEDIUMIObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges managementEPSS 0.2%CVE-2024-37134MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacEPSS 0.2%CVE-2025-0131HIGHGlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDKEPSS 0.2%CVE-2024-39579MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contains an incorrect privilege assignment vulnerability. A local high privileged attEPSS 0.2%CVE-2025-43001MEDIUMMultiple Privilege Escalation Vulnerabilities in SAPCAREPSS 0.2%CVE-2026-67846HIGHBerkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issEPSS 0.2%CVE-2025-27021HIGHOperating System Misconfiguration in Infinera G42EPSS 0.2%CVE-2024-27275HIGHIBM i privilege escalationEPSS 0.2%CVE-2024-46974HIGHGPU DDK - Arbitrary write of read-only dmabufEPSS 0.2%CVE-2026-90493CRITICALTonec Internet Download Manager Kernel Driver idmwfp.sys access controlEPSS 0.2%CVE-2023-5080MEDIUMA privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identiEPSS 0.2%CVE-2026-3667MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorizationEPSS 0.2%CVE-2024-7480MEDIUMImproper access control in Avaya Aura System ManagerEPSS 0.2%CVE-2024-39576HIGHDell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker witEPSS 0.2%CVE-2026-65199MEDIUMHuawei openUBMC low-privilege SNMP to administrator privilege escalationEPSS 0.1%CVE-2024-37132MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. A high privileged attacker wEPSS 0.1%