Weaknesses of type CWE-269

2,520 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-31756HIGHAn issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate privEPSS 0.1%CVE-2026-43657LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be ableEPSS 0.1%CVE-2025-67792HIGHAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulateEPSS 0.1%CVE-2025-43306HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious EPSS 0.1%CVE-2025-57443MEDIUMFrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that alEPSS 0.1%CVE-2026-86893LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 2EPSS 0.1%CVE-2025-6723MEDIUMUntrusted user data can lead to privilege escalationEPSS 0.1%CVE-2025-43722MEDIUMDell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability. A high privileged attacker with EPSS 0.1%CVE-2026-29123HIGHMultiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege EscalationEPSS 0.1%CVE-2025-69257MEDIUMtheshit vulnerable to unsafe loading of user-owned Python rules when running as root.EPSS 0.1%CVE-2026-31369LOWPrivilege Bypass in PcManagerEPSS 0.1%CVE-2025-22165MEDIUMThis Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (ArbitrarEPSS 0.1%CVE-2025-27811HIGHA local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escaEPSS 0.1%CVE-2026-29124HIGHMultiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege EscalationEPSS 0.1%CVE-2026-17863HIGHInappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escEPSS 0.1%CVE-2026-73729MEDIUMAuthenticated Sensitive Information Disclosure in HPE Networking Fabric ComposerEPSS 0.1%CVE-2023-22576HIGHDell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low prEPSS 0.1%CVE-2026-60938MEDIUMVulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions thatEPSS 0.1%CVE-2026-0055MEDIUMIn createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid dirEPSS 0.1%CVE-2025-4879HIGHCitrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegesEPSS 0.1%