Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2023-41715HIGHSonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privilegEPSS 0.8%CVE-2024-22922CRITICALAn issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the lEPSS 0.8%CVE-2023-32244CRITICALWordPress Woodmart Core plugin <= 1.0.36 - Privilege EscalationEPSS 0.8%CVE-2025-43199CRITICALA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VenEPSS 0.8%CVE-2023-4140MEDIUMWP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege EscalationEPSS 0.8%CVE-2024-42366CRITICALVR Overlay RCEEPSS 0.8%CVE-2024-37858CRITICALSQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter toEPSS 0.8%CVE-2021-43793MEDIUMBypass of Poll voting limits in DiscourseEPSS 0.8%CVE-2021-29452HIGHAny logged in user could edit any other logged in user.EPSS 0.8%CVE-2023-22651CRITICALImproper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admissioEPSS 0.8%CVE-2026-66818HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-27639HIGHVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015.EPSS 0.8%CVE-2023-38187MEDIUMMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2021-36316MEDIUMDell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious EPSS 0.8%CVE-2026-120338CRITICALPrefab UI Pyodide sandbox escape to host RCEEPSS 0.8%CVE-2022-23737MEDIUMImproper Privilege Management in GitHub Enterprise Server leading to page creation and deletionEPSS 0.8%CVE-2024-6411HIGHProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege EscalationEPSS 0.8%CVE-2023-41957HIGHWordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerabilityEPSS 0.8%CVE-2025-40548CRITICALSolarWinds Serv-U Broken Access Control - Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-37866HIGHWordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerabilityEPSS 0.8%