Weaknesses of type CWE-708

20 results

Atribuição incorreta de proprietário de recurso

Ocorre quando um programa atribui a propriedade (ownership) de um recurso do sistema—arquivo, processo, objeto em memória—a um usuário ou contexto de segurança errado. Isso permite que um agente não autorizado assuma controle sobre o recurso ou acesse dados que não deveria, comprometendo isolamento e integridade.

Example

Um serviço cria um arquivo temporário com permissões abertas e depois tenta mudar o proprietário, mas falha silenciosamente. Se outro usuário acessa a máquina, consegue ler ou modificar o arquivo antes da correção, ou o arquivo nunca muda de proprietário de fato.

How to mitigate

Sempre validar que a mudança de proprietário foi bem-sucedida antes de prosseguir; definir permissões restritivas no momento da criação do recurso (umask adequado, ACLs explícitas); evitar operações de ownership em janelas de tempo onde o recurso fica desprotegido.

CVE-2021-32726HIGHWebauthn tokens not removed after user has been deletedEPSS 1.8%CVE-2021-32689HIGHNextcloud Talk not properly disassociating users from chats after account deletionEPSS 1.0%CVE-2022-33737—The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a randEPSS 0.8%CVE-2023-4008MEDIUMIncorrect Ownership Assignment in GitLabEPSS 0.7%CVE-2024-9633LOWIncorrect Ownership Assignment in GitLabEPSS 0.4%CVE-2023-41881LOWDeleting a collaboration should also delete linked resourcesEPSS 0.3%CVE-2024-45426MEDIUMZoom Workplace Apps - Incorrect Ownership AssignmentEPSS 0.3%CVE-2024-41773MEDIUMIBM Global Configuration Management incorrect ownership assignmentEPSS 0.3%CVE-2026-40196HIGHHomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access RevocationEPSS 0.2%CVE-2024-52561HIGHA privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a EPSS 0.2%CVE-2026-32691MEDIUMTiming ownership claim attack on new external back-end secretsEPSS 0.2%CVE-2025-5069LOWIncorrect Ownership Assignment in GitLabEPSS 0.2%CVE-2021-26248MEDIUMPhilips MRI 1.5T and 3T Incorrect Ownership AssignmentEPSS 0.2%CVE-2022-22189HIGHContrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authenticationEPSS 0.2%CVE-2023-20043MEDIUMA vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability iEPSS 0.2%CVE-2024-45417MEDIUMZoom Apps for macOS - Uncontrolled Resource ConsumptionEPSS 0.2%CVE-2025-14262MEDIUMJobs can be saved as workflows with wrong permissions on KNIME Business HubEPSS 0.2%CVE-2025-5467LOWUbuntu Apport Insecure File Permissions VulnerabilityEPSS 0.2%CVE-2023-29122MEDIUMIncorrect file ownership of privileged service's libraries in Enel X JuiceBoxEPSS 0.2%CVE-2023-20044MEDIUMA vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability iEPSS 0.1%