Weaknesses of type CWE-269

2,803 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-76801HIGHFireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege EscalationEPSS 0.9%CVE-2022-32801HIGHThis issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain root privileges.EPSS 0.9%CVE-2021-36302CRITICALAll Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A remote malicious user EPSS 0.9%CVE-2018-25040MEDIUMuTorrent Web HTTP RPC Server privileges managementEPSS 0.9%CVE-2026-84869CRITICALScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsEPSS 0.9%KEVCVE-2021-25442—Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication.EPSS 0.9%CVE-2023-6099HIGHShenzhen Youkate Industrial Facial Love Cloud Payment System Account SystemMng.ashx privileges managementEPSS 0.9%CVE-2022-29164HIGHPrivilege Escalation in argo-workflowsEPSS 0.9%CVE-2020-12495CRITICALENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege managementEPSS 0.9%CVE-2023-41322MEDIUMPrivilege Escalation from technician to super-admin in GLPIEPSS 0.9%CVE-2024-45173HIGHAn issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MEPSS 0.9%CVE-2026-14281CRITICALAutomation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' ParameterEPSS 0.9%CVE-2023-41324HIGHAccount takeover through API in GLPIEPSS 0.9%CVE-2024-24892HIGHUnauthorized RCE in migration-toolsEPSS 0.9%CVE-2023-4404CRITICALDonation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege EscalationEPSS 0.9%CVE-2026-14526CRITICALAI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow RouteEPSS 0.9%CVE-2022-26668HIGHASUS Control Center - Broken Access ControlEPSS 0.9%CVE-2025-47955HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-39032HIGHSmart eVision - Improper Privilege ManagementEPSS 0.9%CVE-2023-43120—An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalatEPSS 0.9%