Falhas do tipo CWE-266

1.302 resultados

Atribuição incorreta de privilégios

A aplicação concede permissões ou privilégios a usuários ou processos sem validar adequadamente se essa concessão é apropriada. Isso permite que um atacante escale privilégios, acesse recursos restritos ou execute operações que não deveria estar autorizado a fazer.

Exemplo

Um sistema de backup automático roda com permissões de root para acessar todos os arquivos, mas a interface de administração permite que qualquer usuário autenticado (até nível guest) configure quais diretórios fazer backup — criando a possibilidade de exfiltração de dados sensíveis através de um privilégio excessivamente amplo.

Como mitigar

Aplique princípio do menor privilégio: execute processos e serviços com o mínimo de permissão necessária; valide explicitamente cada mudança de contexto de segurança (ownership, grupos, capabilities) e auditore quem fez a concessão; use controle de acesso baseado em papéis (RBAC) com definições claras de qual papel pode executar qual operação.

CVE-2024-32009HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a loEPSS 0.1%CVE-2025-38738MEDIUMSupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in theEPSS 0.1%CVE-2026-3670MEDIUMFreedom Factory dGEN1 com.dgen.alarm improper authorizationEPSS 0.1%CVE-2026-3674MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorizationEPSS 0.1%CVE-2026-3669MEDIUMFreedom Factory dGEN1 com.dgen.alarm AlarmService improper authorizationEPSS 0.1%CVE-2024-31315MEDIUMIn multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notificatEPSS 0.1%CVE-2025-68420HIGHPrivilege Escalation in Comarch ERP OptimaEPSS 0.1%CVE-2026-12217HIGHDVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges managementEPSS 0.1%CVE-2026-109520CRITICALColorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actionsEPSS 0.1%CVE-2025-36612MEDIUMSupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attEPSS 0.1%CVE-2026-108835MEDIUMYungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges managementEPSS 0.1%CVE-2026-63349HIGHAnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsEPSS 0.1%CVE-2026-123665LOWkubescape Output printresults.go GetWriter permissionEPSS 0.1%CVE-2025-43914HIGHDell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release versionEPSS 0.1%CVE-2026-12201MEDIUMIObit Malware Fighter DLL permissionEPSS 0.1%CVE-2026-21425MEDIUMDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulneraEPSS 0.1%CVE-2026-86935MEDIUMThis issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access userEPSS 0.1%CVE-2026-8148HIGHNAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipuEPSS 0.1%CVE-2025-26425MEDIUMIn multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This couEPSS 0.1%CVE-2026-77055CRITICALImproper Privilege Assignment in boneIOEPSS 0.1%