Weaknesses of type CWE-264

299 results

Controle de acesso e privilégios inadequado

A fraqueza ocorre quando a aplicação não valida corretamente quem pode fazer o quê, permitindo que usuários acessem recursos ou executem operações acima de seus privilégios. Isso acontece porque as verificações de autorização são ausentes, incompletas ou contornáveis, expondo dados sensíveis ou permitindo ações não autorizadas.

Example

Um usuário comum consegue listar ou modificar dados de outros usuários alterando um ID na URL (ex: /profile/123 → /profile/999) sem que o servidor valide se ele tem permissão para acessar aquele perfil. Ou um atacante executa ações administrativas porque a aplicação só verifica autenticação, não autorização.

How to mitigate

Implemente verificações de autorização em toda operação sensível: valide não apenas se o usuário está logado, mas se ele tem permissão específica para aquele recurso. Use listas de controle de acesso (ACL), roles bem definidas e princípio do menor privilégio. Teste sistematicamente tentativas de escalação e acesso lateral entre usuários.

CVE-2024-32996MEDIUMPrivilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2023-44281MEDIUM Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with local access to the EPSS 0.2%CVE-2023-24573MEDIUM Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticatEPSS 0.2%CVE-2026-81644MEDIUMDoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-20046HIGHCisco IOS XR Software CLI Privilege Escalation VulnerabilityEPSS 0.1%CVE-2021-25482MEDIUMSQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA frameworkEPSS 0.1%CVE-2025-48903HIGHPermission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2024-51524MEDIUMPermission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentialitEPSS 0.1%CVE-2022-3421MEDIUMPrivilege escalation in Google Drive for Desktop on MacOSEPSS 0.1%CVE-2026-24923MEDIUMPermission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2017-9711MEDIUMPermissions, Privileges, and Access Controls in DataEPSS 0.1%CVE-2026-58555MEDIUMPermission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2024-53011HIGHPermissions, Privileges, and Access Controls in Video Analytics and ProcessingEPSS 0.1%CVE-2026-58556MEDIUMPermission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2023-7265MEDIUMPermission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availabilitEPSS 0.1%CVE-2025-68967MEDIUMVulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2026-24924MEDIUMVulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2024-45449MEDIUMAccess permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affectEPSS 0.1%CVE-2023-21641MEDIUMPermissions, Privileges, and Access Controls in DisplayEPSS 0.1%CVE-2024-39670MEDIUMPrivilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulnerability will affect EPSS 0.1%