Falhas do tipo CWE-280

178 resultados

Tratamento inadequado de permissões ou privilégios insuficientes

Ocorre quando o aplicativo não verifica corretamente se o usuário ou processo possui as permissões necessárias antes de executar uma ação sensível. O código assume que a operação foi autorizada sem validar o contexto de segurança, permitindo que usuários sem privilégio acessem recursos ou executem ações restritas.

Exemplo

Um painel administrativo que lista usuários sensíveis sem validar se o requisitante é administrador; qualquer usuário autenticado consegue acessar a rota /admin/users apenas porque a aplicação não verifica role ou permissão específica.

Como mitigar

Implementar controle de acesso explícito: valide permissões em cada operação sensível (authorization checks), use padrões como RBAC ou ABAC, e considere frameworks que forçam validação (ex: @RequireRole, middleware de permissões). Teste negativo: confirme que usuários sem privilégio são bloqueados.

CVE-2026-84631HIGHThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root prEPSS 0.1%CVE-2026-59567HIGHLocal privilege escalationEPSS 0.1%CVE-2025-0478HIGHGPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM objectEPSS 0.1%CVE-2026-64701HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious aEPSS 0.1%CVE-2026-20448MEDIUMIn geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegEPSS 0.1%CVE-2024-43705HIGHGPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)EPSS 0.1%CVE-2026-45196HIGHGPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernelEPSS 0.1%CVE-2026-45195HIGHGPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrustedEPSS 0.1%CVE-2025-25179HIGHGPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memoryEPSS 0.1%CVE-2024-51459HIGHIBM InfoSphere Server Information command executionEPSS 0.1%CVE-2025-46584HIGHVulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerabilitEPSS 0.1%CVE-2026-21736MEDIUMGPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabledEPSS 0.1%CVE-2024-8315MEDIUMImproper Handling of Insufficient Permissions or Privileges in B&R APROLEPSS 0.1%CVE-2026-21099MEDIUMImproper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.EPSS 0.1%CVE-2026-0047HIGHIn dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permisEPSS 0.1%CVE-2022-22292HIGHUnprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity.EPSS 0.1%CVE-2026-79403HIGHAn issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpointEPSS 0.1%CVE-2026-46054HIGHselinux: fix overlayfs mmap() and mprotect() access checksEPSS 0.1%CVE-2025-58770HIGHTCG2 TPM RT Not Locked IssueEPSS 0.1%CVE-2022-39912MEDIUMImproper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows EPSS 0.1%