Fallos del tipo CWE-653

71 resultados

Falta de segregação de privilégios e funcionalidades

A aplicação não separa adequadamente componentes, processos ou recursos que exigem diferentes níveis de permissão, deixando funcionalidades críticas acessíveis a usuários com menos privilégios. Um atacante com acesso limitado consegue executar operações que deveriam estar restritas a administradores ou roles específicas.

Ejemplo

Uma API REST que usa a mesma função para listar tarefas do usuário e deletar todas as tarefas do sistema sem verificar se o chamador é admin. Um usuário comum consegue chamar a mesma rota com um parâmetro diferente e excluir dados de todos.

Cómo mitigar

Implemente verificações de autorização em cada operação sensível (não confie apenas em controle de acesso na camada de rede), use padrões como RBAC ou ABAC, e teste permissões explicitamente para cada nível de privilégio. Considere microsserviços isolados para funções críticas que requerem privilégios elevados.

CVE-2026-4692CRITICALSandbox escape in the Responsive Design Mode componentEPSS 0.5%CVE-2023-1636MEDIUMIncomplete container isolationEPSS 0.5%CVE-2026-53405CRITICALApache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTaskEPSS 0.4%CVE-2026-63071CRITICALApache Syncope: RCE via Groovy Sandbox bypassEPSS 0.4%CVE-2024-53855LOWUser can view tickets from organizations they're not apart of in centurion_erpEPSS 0.4%CVE-2025-4083CRITICALProcess isolation bypass using "javascript:" URI links in cross-origin framesEPSS 0.4%CVE-2026-4282HIGHKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawEPSS 0.4%CVE-2024-47520HIGHA user with advanced report application access rights can perform actions for which they are not authorizedEPSS 0.4%CVE-2024-55456MEDIUMlunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cellEPSS 0.4%CVE-2026-12297CRITICALSandbox escape due to incorrect boundary conditions in the Networking componentEPSS 0.4%CVE-2026-12295CRITICALSandbox escape in the DOM: Navigation componentEPSS 0.4%CVE-2025-3086MEDIUMUser in anonymous role could create and delete viewsEPSS 0.4%CVE-2025-12805HIGHLlama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicyEPSS 0.4%CVE-2024-49373MEDIUMCenturion ERP user can view projects from organizations they're not apart ofEPSS 0.4%CVE-2026-15738MEDIUMCross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer ControllerEPSS 0.4%CVE-2026-8945HIGHSandbox escape in Firefox and Firefox Focus for AndroidEPSS 0.4%CVE-2024-23683HIGHArtemis Java Test Sandbox InvocationTargetException Subclass EscapeEPSS 0.4%CVE-2024-23682HIGHArtemis Java Test Sandbox Class Loading EscapeEPSS 0.4%CVE-2024-57720MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.EPSS 0.3%CVE-2024-57723MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.EPSS 0.3%