Weaknesses of type CWE-269

2,489 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-43401CRITICALIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themEPSS 0.7%CVE-2023-36100—An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameterEPSS 0.7%CVE-2022-45963CRITICALh3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.EPSS 0.7%CVE-2024-32003HIGHDusk plugin may allow unfettered user authentication in misconfigured installsEPSS 0.7%CVE-2023-37389HIGHWordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.7%CVE-2023-21987HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PrioEPSS 0.7%CVE-2021-45729MEDIUMWordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerabilityEPSS 0.7%CVE-2025-7851HIGHUnauthorized root access via debug functionalityEPSS 0.7%CVE-2026-14526CRITICALAI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow RouteEPSS 0.7%CVE-2026-32760CRITICALFile Browser Self Registration Grants Any User Admin Access When Default Permissions Include AdminEPSS 0.7%CVE-2023-5402CRITICAL A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used EPSS 0.7%CVE-2026-7641HIGHImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsEPSS 0.7%CVE-2022-39007CRITICALThe location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privileEPSS 0.7%CVE-2026-33821HIGHMicrosoft Dynamics 365 Customer Insights Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-29018HIGH OpenFeature Operator vulnerable to Cluster-level Privilege EscalationEPSS 0.7%CVE-2026-27208CRITICALapi-gateway-deploy Affected by Exploitable Command Injection via Unprivileged Root ExecutionEPSS 0.7%CVE-2026-34528HIGHFile Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionEPSS 0.7%CVE-2026-24072HIGHApache HTTP Server: mod_rewrite elevation of privileges via ap_exprEPSS 0.7%CVE-2025-0505CRITICALOn Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system stateEPSS 0.7%CVE-2023-41715HIGHSonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privilegEPSS 0.7%