Weaknesses of type CWE-269

2,795 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2019-1215HIGHAn elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of PrEPSS 19.3%KEVCVE-2025-24286HIGHA vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.EPSS 19.1%CVE-2023-40289HIGHA command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevatEPSS 18.4%CVE-2023-2833HIGHReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege EscalationEPSS 17.5%CVE-2024-5009HIGHWhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation VulnerabilityEPSS 17.4%CVE-2023-38944CRITICALAn issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access EPSS 15.5%CVE-2025-47411HIGHApache StreamPipes: Leverage of User ID for Privilege EscalationEPSS 15.3%CVE-2021-1388CRITICALCisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass VulnerabilityEPSS 14.8%CVE-2024-12284HIGHAuthenticated privilege escalationEPSS 13.3%CVE-2026-46817CRITICALVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affecteEPSS 12.3%KEVCVE-2026-102490HIGHLocal privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packageEPSS 10.9%KEVCVE-2013-0643HIGHThe Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 anEPSS 10.5%KEVCVE-2017-7922—An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly rEPSS 9.6%CVE-2025-8489CRITICALKing Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege EscalationEPSS 9.6%CVE-2024-29976MEDIUM** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware vEPSS 9.0%CVE-2019-1388HIGHAn elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'WinEPSS 8.6%KEVCVE-2023-28434HIGHMinIO is vulnerable to privilege escalation on Linux/MacOSEPSS 7.9%KEVCVE-2020-3950HIGHVMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior bEPSS 7.3%KEVCVE-2026-12269HIGHAuthenticated File Write to RCE via keepalived in DDI CentralEPSS 7.0%CVE-2025-4601HIGHRH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 7.0%