Weaknesses of type CWE-269

2,520 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2017-13165MEDIUMAn elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.EPSS 0.1%CVE-2026-20044MEDIUMCisco Secure Firewall Management Center Command Injection VulnerabilityEPSS 0.1%CVE-2025-1121MEDIUMPrivilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physicEPSS 0.1%CVE-2026-73740MEDIUMLocal Privilege Escalation in HPE Networking Fabric ComposerEPSS 0.1%CVE-2026-21981MEDIUMVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.EPSS 0.1%CVE-2026-16703HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2025-7406HIGHA Sudo Privilege Escalation Vulnerability in Nokia MantaRay NMEPSS 0.1%CVE-2025-66266CRITICALInsecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege EscalationEPSS 0.1%CVE-2026-16991HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-84089HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.1%CVE-2026-18071HIGHIBM i is Affected By An Improper Management Vulnerability in HTTP Server []EPSS 0.1%CVE-2026-14551HIGHLocal Privilege Escalation in servereye client (sensorhub)EPSS 0.1%CVE-2024-31757HIGHAn issue in TeraByte Unlimited Image for Windows v.3.64.0.0 and before and fixed in v.4.0.0.0 allows a local attacker to escalate privilegesEPSS 0.1%CVE-2026-19449HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2024-27264HIGHIBM Performance Tools for i privilege escalationEPSS 0.1%CVE-2026-47868HIGHVMware Avi Load Balancer Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2024-31756HIGHAn issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate privEPSS 0.1%CVE-2026-18101HIGHIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyEPSS 0.1%CVE-2026-16937HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-84042HIGHCrun: crun: rootful krun with passt executes container payload as host rootEPSS 0.1%