Falhas do tipo CWE-280

169 resultados

Tratamento inadequado de permissões ou privilégios insuficientes

Ocorre quando o aplicativo não verifica corretamente se o usuário ou processo possui as permissões necessárias antes de executar uma ação sensível. O código assume que a operação foi autorizada sem validar o contexto de segurança, permitindo que usuários sem privilégio acessem recursos ou executem ações restritas.

Exemplo

Um painel administrativo que lista usuários sensíveis sem validar se o requisitante é administrador; qualquer usuário autenticado consegue acessar a rota /admin/users apenas porque a aplicação não verifica role ou permissão específica.

Como mitigar

Implementar controle de acesso explícito: valide permissões em cada operação sensível (authorization checks), use padrões como RBAC ou ABAC, e considere frameworks que forçam validação (ex: @RequireRole, middleware de permissões). Teste negativo: confirme que usuários sem privilégio são bloqueados.

CVE-2026-44199MEDIUMWagtail: Improper permission handling when deleting form submissionsEPSS 0.2%CVE-2025-3931HIGHYggdrasil: local privilege escalation in yggdrasilEPSS 0.2%CVE-2026-54471LOWDell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A EPSS 0.2%CVE-2023-32489MEDIUM Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. A local attacker with high privileges could potentially expEPSS 0.2%CVE-2023-43591HIGHImproper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of priEPSS 0.2%CVE-2025-58122MEDIUMInsufficient permission validation when configuring notification parametersEPSS 0.2%CVE-2023-25543HIGH Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privileged malicious userEPSS 0.2%CVE-2026-44198MEDIUMWagtail: Improper permission handling when viewing page historyEPSS 0.2%CVE-2026-20463MEDIUMIn Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malEPSS 0.2%CVE-2025-43527HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may beEPSS 0.2%CVE-2022-39872MEDIUMImproper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.EPSS 0.2%CVE-2024-32488HIGHIn Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the upEPSS 0.2%CVE-2023-21421MEDIUMImproper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allowsEPSS 0.2%CVE-2026-43786HIGHThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26EPSS 0.1%CVE-2026-20448MEDIUMIn geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegEPSS 0.1%CVE-2024-43705HIGHGPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)EPSS 0.1%CVE-2025-0478HIGHGPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM objectEPSS 0.1%CVE-2026-45196HIGHGPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernelEPSS 0.1%CVE-2026-45195HIGHGPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrustedEPSS 0.1%CVE-2026-0047HIGHIn dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permisEPSS 0.1%