Falhas do tipo CWE-266

1.302 resultados

Atribuição incorreta de privilégios

A aplicação concede permissões ou privilégios a usuários ou processos sem validar adequadamente se essa concessão é apropriada. Isso permite que um atacante escale privilégios, acesse recursos restritos ou execute operações que não deveria estar autorizado a fazer.

Exemplo

Um sistema de backup automático roda com permissões de root para acessar todos os arquivos, mas a interface de administração permite que qualquer usuário autenticado (até nível guest) configure quais diretórios fazer backup — criando a possibilidade de exfiltração de dados sensíveis através de um privilégio excessivamente amplo.

Como mitigar

Aplique princípio do menor privilégio: execute processos e serviços com o mínimo de permissão necessária; valide explicitamente cada mudança de contexto de segurança (ownership, grupos, capabilities) e auditore quem fez a concessão; use controle de acesso baseado em papéis (RBAC) com definições claras de qual papel pode executar qual operação.

CVE-2026-27102MEDIUMDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1, contains an incorrect privilege assignment EPSS 0.1%CVE-2025-48526MEDIUMIn createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profEPSS 0.1%CVE-2023-21269—In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL byEPSS 0.1%CVE-2025-32747MEDIUMDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with localEPSS 0.1%CVE-2025-48528MEDIUMIn multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalationEPSS 0.1%CVE-2026-53862LOWOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope WideningEPSS 0.1%CVE-2023-20957HIGHIn onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This couldEPSS 0.1%CVE-2024-49731MEDIUMIn apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to aEPSS 0.1%CVE-2024-34738HIGHIn multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due EPSS 0.1%CVE-2025-22415MEDIUMIn android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilEPSS 0.1%CVE-2025-2713MEDIUMImproper File Permission Handling in Google gVisor runscEPSS 0.1%CVE-2026-124590MEDIUMzhangbw409 library_manager_system UserController.java BookController.addBook improper authorizationEPSS —CVE-2026-124569MEDIUMfushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access controlEPSS —CVE-2026-3684MEDIUMVulnerabilities exists in IBM Cloud Pak for Data SystemEPSS —CVE-2026-109900CRITICALWordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerabilityEPSS —CVE-2026-124429HIGHCraft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public RegistrationEPSS —CVE-2026-124501MEDIUMTidelift moto AWS Batch Emulation models.py privileges managementEPSS —CVE-2026-124568MEDIUMfushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access controlEPSS —CVE-2026-119514MEDIUMWordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerabilityEPSS —CVE-2026-124574MEDIUMchenyme grok2api Video Job Retry video.go beginSelectionSession improper authorizationEPSS —