Weaknesses of type CWE-269

2,489 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2017-20038MEDIUMSICUNET Access Controller card_scan_decoder.php privileges managementEPSS 0.7%CVE-2022-42888CRITICALWordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege EscalationEPSS 0.7%CVE-2023-2240HIGHImproper Privilege Management in microweber/microweberEPSS 0.7%CVE-2022-35243HIGHAuthenticated iControl REST in Appliance mode vulnerability CVE-2022-35243EPSS 0.7%CVE-2022-4173HIGHAvast and AVG Antivirus for Windows vulnerable to Privilege EscalationEPSS 0.7%CVE-2025-40548CRITICALSolarWinds Serv-U Broken Access Control - Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-6218HIGHMOVEit Transfer Group Admin Privilege EscalationEPSS 0.7%CVE-2023-23990HIGHWordPress Redirection for Contact Form 7 plugin <= 2.7.0 - Privilege Escalation vulnerabilityEPSS 0.7%CVE-2022-31039MEDIUMImproper privilege management - Anyone can view room settings in GreenLightEPSS 0.7%CVE-2022-35291HIGHPrivilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)EPSS 0.7%CVE-2026-84869CRITICALScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsEPSS 0.7%KEVCVE-2026-62183CRITICALApache Syncope: User self-service privilege escalationEPSS 0.7%CVE-2023-7090MEDIUMSudo: improper handling of ipa_hostname leads to privilege mismanagementEPSS 0.7%CVE-2026-22721MEDIUMVMware Aria Operations privilege escalation vulnerabilityEPSS 0.7%CVE-2024-41666MEDIUMThe Argo CD web terminal session does not handle the revocation of user permissions properly.EPSS 0.7%CVE-2026-59260HIGHOpenWrt luci-app-samba4 read ACL remote code execution via smbdEPSS 0.7%CVE-2024-24778MEDIUMApache StreamPipes: Resources Permission EscalationEPSS 0.7%CVE-2025-34204HIGHVasion Print (formerly PrinterLogic) Processes Running as Root Inside Docker InstancesEPSS 0.7%CVE-2024-43401CRITICALIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themEPSS 0.7%CVE-2022-43759HIGHRancher: Privilege escalation via promoted rolesEPSS 0.7%