Weaknesses of type CWE-269

2,822 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2023-44250HIGHAn improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a ForEPSS 0.9%CVE-2021-36307HIGHNetworking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low prEPSS 0.9%CVE-2022-42459HIGHWordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerabilityEPSS 0.9%CVE-2021-36784HIGHPrivilege escalation for users with create/update permissions in Global RolesEPSS 0.9%CVE-2022-38757HIGHCVE-2022-38757 ZENworksEPSS 0.9%CVE-2018-14808—Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected productEPSS 0.9%CVE-2021-24158—Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege EscalationEPSS 0.9%CVE-2022-39202MEDIUMIRC mode parameter confusion in matrix-appservice-ircEPSS 0.9%CVE-2023-27589MEDIUMMinio vulnerable to denial of access by an admin privileged user for root credentialEPSS 0.9%CVE-2025-22254MEDIUMAn Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6,EPSS 0.9%CVE-2023-45581HIGHAn improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 EPSS 0.9%CVE-2025-22829LOWApache CloudStack: Unauthorised access to dedicated resources in Quota pluginEPSS 0.9%CVE-2023-1326HIGHlocal privilege escalation in apport-cliEPSS 0.9%CVE-2022-39203HIGHParsing issue in matrix-org/node-irc leading to room takeoversEPSS 0.9%CVE-2024-36439CRITICALSwissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash EPSS 0.9%CVE-2017-20063MEDIUMElefant CMS File Upload drop privileges managementEPSS 0.9%CVE-2019-1162HIGHWindows ALPC Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-1762HIGHImproper Privilege Management in thorsten/phpmyfaqEPSS 0.9%CVE-2026-59260HIGHOpenWrt luci-app-samba4 read ACL remote code execution via smbdEPSS 0.9%CVE-2021-31350HIGHJunos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Toolkit (JET)EPSS 0.9%