Falhas do tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2026-53870MEDIUMHermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store FilesEPSS 0.1%CVE-2026-63425HIGHDuring an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could alloEPSS 0.1%CVE-2025-61667HIGHDatadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissionsEPSS 0.1%CVE-2025-48512HIGHIncorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attackEPSS 0.1%CVE-2026-28727HIGHLocal privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) beEPSS 0.1%CVE-2024-58050MEDIUMVulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may affect service confiEPSS 0.1%CVE-2026-0432HIGHIncorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalatiEPSS 0.1%CVE-2025-1789MEDIUMLocal privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this vulnerability to gaiEPSS 0.1%CVE-2026-28267MEDIUMMultiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system diEPSS 0.1%CVE-2026-44469HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2025-27711MEDIUMIncorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User AppEPSS 0.1%CVE-2026-48790MEDIUMturso-cli persists Turso platform JWT with world-readable (0o644) file permissionsEPSS 0.1%CVE-2025-8421MEDIUMAn improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could aEPSS 0.1%CVE-2026-0705MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before bEPSS 0.1%CVE-2025-61970HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codEPSS 0.1%CVE-2024-43081HIGHIn installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the codEPSS 0.1%CVE-2026-21074HIGHIncorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.EPSS 0.1%CVE-2025-69604HIGHAn issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary pEPSS 0.1%CVE-2026-0539HIGHLocal Privilege Escalation in pcvisit service clientEPSS 0.1%CVE-2026-21765HIGHHCL BigFix Platform is affected by insecure permissions on private cryptographic keysEPSS 0.1%