Fallos del tipo CWE-266

1302 resultados

Atribuição Incorreta de Privilégios

Quando um sistema concede permissões ou privilégios a um usuário, processo ou recurso de forma inadequada — maior que o necessário ou para a entidade errada. Isso permite que atacantes escalem privilégios ou acessem dados/funcionalidades que não deveriam ter.

Ejemplo

Um aplicativo web cria uma pasta temporária com permissões 777 (leitura, escrita e execução para todos), ou um serviço Windows roda como SYSTEM quando deveria rodar como usuário comum. Outro cenário: uma função administrativa fica acessível via URL sem validação, permitindo qualquer usuário logado executá-la.

Cómo mitigar

Aplique o princípio do menor privilégio: conceda apenas as permissões mínimas necessárias. Use ACLs restritivas, validação de roles/permissões em cada função sensível, execute serviços com contas de baixo privilégio, e mantenha auditoria de mudanças de permissões.

CVE-2024-32009HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a loEPSS 0.1%CVE-2025-38738MEDIUMSupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in theEPSS 0.1%CVE-2026-3670MEDIUMFreedom Factory dGEN1 com.dgen.alarm improper authorizationEPSS 0.1%CVE-2026-3674MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorizationEPSS 0.1%CVE-2026-3669MEDIUMFreedom Factory dGEN1 com.dgen.alarm AlarmService improper authorizationEPSS 0.1%CVE-2024-31315MEDIUMIn multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notificatEPSS 0.1%CVE-2025-68420HIGHPrivilege Escalation in Comarch ERP OptimaEPSS 0.1%CVE-2026-12217HIGHDVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges managementEPSS 0.1%CVE-2026-109520CRITICALColorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actionsEPSS 0.1%CVE-2025-36612MEDIUMSupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attEPSS 0.1%CVE-2026-108835MEDIUMYungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges managementEPSS 0.1%CVE-2026-63349HIGHAnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsEPSS 0.1%CVE-2026-123665LOWkubescape Output printresults.go GetWriter permissionEPSS 0.1%CVE-2025-43914HIGHDell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release versionEPSS 0.1%CVE-2026-12201MEDIUMIObit Malware Fighter DLL permissionEPSS 0.1%CVE-2026-21425MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulneraEPSS 0.1%CVE-2026-86935MEDIUMThis issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access userEPSS 0.1%CVE-2026-8148HIGHNAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipuEPSS 0.1%CVE-2025-26425MEDIUMIn multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This couEPSS 0.1%CVE-2026-77055CRITICALImproper Privilege Assignment in boneIOEPSS 0.1%