Weaknesses of type CWE-269

2,793 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2017-20021MEDIUMSolare Solar-Log File Upload privileges managementEPSS 1.0%CVE-2026-102093HIGHKiteworks Core improper privilege managementEPSS 1.0%CVE-2026-25770CRITICALWazuh has Privilege Escalation to Root via Cluster Protocol File WriteEPSS 1.0%CVE-2022-31707HIGHvRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the ImpoEPSS 1.0%CVE-2021-37627HIGHPrivilege escalation via form generatorEPSS 1.0%CVE-2020-7305MEDIUMDLP ePO extension - Privilege escalationEPSS 1.0%CVE-2024-45496CRITICALOpenshift-controller-manager: elevated build pods can lead to node compromise in openshiftEPSS 1.0%CVE-2022-3422CRITICALImproper Privilege Management in tooljet/tooljetEPSS 1.0%CVE-2025-49758HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-34331CRITICALA lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted mEPSS 1.0%CVE-2018-25044MEDIUMuTorrent Guest Account privileges managementEPSS 1.0%CVE-2016-15002HIGHMONyog Ultimate Cookie privileges managementEPSS 1.0%CVE-2023-4293HIGHPremium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege EscalationEPSS 1.0%CVE-2022-48341—ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain SyEPSS 1.0%CVE-2023-36765HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2022-27487HIGHA improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptorEPSS 1.0%CVE-2021-34766MEDIUMCisco Smart Software Manager Privilege Escalation VulnerabilityEPSS 1.0%CVE-2025-59693CRITICALThe Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) EPSS 1.0%CVE-2021-36207HIGHMetasys privilege managementEPSS 1.0%