Falhas do tipo CWE-280

169 resultados

Tratamento inadequado de permissões ou privilégios insuficientes

Ocorre quando o aplicativo não verifica corretamente se o usuário ou processo possui as permissões necessárias antes de executar uma ação sensível. O código assume que a operação foi autorizada sem validar o contexto de segurança, permitindo que usuários sem privilégio acessem recursos ou executem ações restritas.

Exemplo

Um painel administrativo que lista usuários sensíveis sem validar se o requisitante é administrador; qualquer usuário autenticado consegue acessar a rota /admin/users apenas porque a aplicação não verifica role ou permissão específica.

Como mitigar

Implementar controle de acesso explícito: valide permissões em cada operação sensível (authorization checks), use padrões como RBAC ou ABAC, e considere frameworks que forçam validação (ex: @RequireRole, middleware de permissões). Teste negativo: confirme que usuários sem privilégio são bloqueados.

CVE-2022-21814MEDIUMNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissioEPSS 0.2%CVE-2026-11764LOWData exposed without proper permissionEPSS 0.2%CVE-2022-30716MEDIUMUnprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access tEPSS 0.2%CVE-2025-0468HIGHGPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)EPSS 0.2%CVE-2023-0181HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not coEPSS 0.2%CVE-2026-27910HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2021-37851HIGHLocal Privilege Escalation in ESET product for WindowsEPSS 0.2%CVE-2026-44197MEDIUMWagtail: Improper permission handling when comparing revisionsEPSS 0.2%CVE-2026-44200MEDIUMWagtail: Improper permission handling when copying pagesEPSS 0.2%CVE-2020-10072MEDIUMImproper Handling of Insufficient Permissions or Privileges in zephyrEPSS 0.2%CVE-2022-36874MEDIUMImproper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access EPSS 0.2%CVE-2026-55468MEDIUMWagtail: Improper restriction handling on Pages admin APIEPSS 0.2%CVE-2025-58121MEDIUMInsufficient permission validation on multiple REST API endpointsEPSS 0.2%CVE-2025-22395HIGHDell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attEPSS 0.2%CVE-2023-28114MEDIUM`cilium-cli` disables etcd authorization for clustermesh clustersEPSS 0.2%CVE-2025-30453HIGHThe issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13EPSS 0.2%CVE-2022-27167HIGHArbitrary File Deletion in ESET products for WindowsEPSS 0.2%CVE-2025-46708MEDIUMGPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMsEPSS 0.2%CVE-2023-2480HIGHElevation of Privilege in M-Files Desktop ClientEPSS 0.2%CVE-2024-27837HIGHA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gaEPSS 0.2%