Weaknesses of type CWE-269

2,519 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-21882HIGHtheshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-executionEPSS 0.2%CVE-2023-47145HIGHIBM Db2 for Windows privilege escalationEPSS 0.2%CVE-2018-6674MEDIUMPrivilege escalation vulnerability in McAfee VSE when McTray run with elevated privilegesEPSS 0.2%CVE-2022-43535HIGHA vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. AEPSS 0.2%CVE-2023-25590HIGHLocal Privilege Escalation in ClearPass OnGuard Linux AgentEPSS 0.2%CVE-2023-21272—In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation EPSS 0.2%CVE-2022-35257HIGHA local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local acceEPSS 0.2%CVE-2025-36630HIGHLocal Privilege EscalationEPSS 0.2%CVE-2024-38830HIGHLocal privilege escalation vulnerabilityEPSS 0.2%CVE-2024-29210LOWA local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its configEPSS 0.2%CVE-2023-44217HIGH A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local loEPSS 0.2%CVE-2022-21827—An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 wEPSS 0.2%CVE-2023-45320MEDIUMUncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potenEPSS 0.2%CVE-2024-6326LOWRockwell Automation Unsecured Private Keys in FactoryTalk® System ServicesEPSS 0.2%CVE-2024-33393MEDIUMAn issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the toEPSS 0.2%CVE-2023-3160HIGHLocal privilege escalation in security products for WindowsEPSS 0.2%CVE-2024-7890MEDIUMLocal privilege escalation allows a low-privileged user to gain SYSTEM privilegesEPSS 0.2%CVE-2022-34438MEDIUMDell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malicious user with high pEPSS 0.2%CVE-2025-58432MEDIUMZimaOS Privilege Escalation using localhost calls to File API UploadEPSS 0.2%CVE-2025-33187CRITICALNVIDIA DGX Spark GB10 contains a vulnerability in SROOT, where an attacker could use privileged access to gain access to SoC protected areasEPSS 0.2%