Falhas do tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2018-6674MEDIUMPrivilege escalation vulnerability in McAfee VSE when McTray run with elevated privilegesEPSS 0.2%CVE-2024-54103MEDIUMVulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidEPSS 0.2%CVE-2020-7263MEDIUMENS configuration can be edited by attacker with local administrator permissionsEPSS 0.2%CVE-2024-20370MEDIUMA vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA) Software and Cisco EPSS 0.2%CVE-2023-52721MEDIUMThe WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerability may affect confideEPSS 0.2%CVE-2024-32996MEDIUMPrivilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2023-44281MEDIUM Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with local access to the EPSS 0.2%CVE-2023-24573MEDIUM Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticatEPSS 0.2%CVE-2026-20046HIGHCisco IOS XR Software CLI Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-101177LOWPermission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentEPSS 0.1%CVE-2026-101176HIGHPermission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affeEPSS 0.1%CVE-2025-48903HIGHPermission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2021-25482MEDIUMSQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA frameworkEPSS 0.1%CVE-2026-24923MEDIUMPermission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-66319LOWPermission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect serviceEPSS 0.1%CVE-2026-49308MEDIUMPermission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentEPSS 0.1%CVE-2022-3421MEDIUMPrivilege escalation in Google Drive for Desktop on MacOSEPSS 0.1%CVE-2024-51524MEDIUMPermission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2026-24924MEDIUMVulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-53011HIGHPermissions, Privileges, and Access Controls in Video Analytics and ProcessingEPSS 0.1%