Fallos del tipo CWE-280

169 resultados

Tratamento inadequado de permissões ou privilégios insuficientes

A aplicação não verifica ou não reage corretamente quando um usuário tenta executar uma ação sem as permissões necessárias. Em vez de negar o acesso de forma segura, o sistema pode ignorar a falta de permissão, executar a operação parcialmente, ou deixar dados sensíveis expostos. Isso permite que usuários não autorizados acessem ou modifiquem recursos restritos.

Ejemplo

Um portal administrativo que tenta ocultar o botão 'Deletar usuário' via CSS para usuários comuns, mas não valida permissões no backend. Um atacante remove o CSS ou chama a API diretamente e consegue deletar qualquer usuário. Ou ainda: um sistema que registra um log quando acesso é negado, mas executa 80% da operação sensível antes de verificar permissões.

Cómo mitigar

Implemente validação de permissões no servidor (nunca confie no cliente) antes de qualquer operação sensível. Use um modelo de controle de acesso (RBAC, ABAC) consistente, valide permissões em toda camada de negócio, não apenas na UI, e falhe de forma segura — rejeite completamente a operação se houver dúvida sobre privilégios.

CVE-2026-44199MEDIUMWagtail: Improper permission handling when deleting form submissionsEPSS 0.2%CVE-2025-3931HIGHYggdrasil: local privilege escalation in yggdrasilEPSS 0.2%CVE-2026-54471LOWDell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A EPSS 0.2%CVE-2023-32489MEDIUM Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially expEPSS 0.2%CVE-2023-43591HIGHImproper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of priEPSS 0.2%CVE-2025-58122MEDIUMInsufficient permission validation when configuring notification parametersEPSS 0.2%CVE-2023-25543HIGH Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious userEPSS 0.2%CVE-2026-44198MEDIUMWagtail: Improper permission handling when viewing page historyEPSS 0.2%CVE-2026-20463MEDIUMIn Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malEPSS 0.2%CVE-2025-43527HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may beEPSS 0.2%CVE-2022-39872MEDIUMImproper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.EPSS 0.2%CVE-2024-32488HIGHIn Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the upEPSS 0.2%CVE-2023-21421MEDIUMImproper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allowsEPSS 0.2%CVE-2026-43786HIGHThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26EPSS 0.1%CVE-2026-20448MEDIUMIn geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegEPSS 0.1%CVE-2024-43705HIGHGPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)EPSS 0.1%CVE-2025-0478HIGHGPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM objectEPSS 0.1%CVE-2026-45196HIGHGPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernelEPSS 0.1%CVE-2026-45195HIGHGPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrustedEPSS 0.1%CVE-2026-0047HIGHIn dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permisEPSS 0.1%