Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-17145CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.7%CVE-2023-41807CRITICALLinux Local Privilege Escalation Via GoTTY PageEPSS 0.7%CVE-2026-40920CRITICALApache Ranger: Privilege Escalation via URL ParameterEPSS 0.7%CVE-2022-35291HIGHPrivilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)EPSS 0.7%CVE-2022-43749MEDIUMImproper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authEPSS 0.7%CVE-2023-5402CRITICAL A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used EPSS 0.7%CVE-2026-14328HIGHEazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST EndpointEPSS 0.7%CVE-2021-37938—It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf fileEPSS 0.7%CVE-2023-51424CRITICALWordPress WebinarIgnition plugin <= 3.05.0 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.7%CVE-2025-14736CRITICALFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form FieldEPSS 0.7%CVE-2022-45963CRITICALh3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.EPSS 0.7%CVE-2024-24830CRITICALOpenObserve Privilege Escalation Vulnerability in Users APIEPSS 0.7%CVE-2026-86153CRITICALTenda CP3 Redirect.cpp SetRedirectEnable privileges managementEPSS 0.7%CVE-2019-25151MEDIUMFunnel Builder <= 1.3.0 - Arbitrary Plugin ActivationEPSS 0.7%CVE-2021-37937MEDIUMElasticsearch privilege escalationEPSS 0.7%CVE-2026-9018HIGHEasy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' ParameterEPSS 0.7%CVE-2023-41243HIGHWordPress WPvivid Backup Plugin plugin <= 0.9.90 - Privilege Escalation on Staging Environment vulnerabilityEPSS 0.7%CVE-2023-39734—The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token anEPSS 0.7%CVE-2019-1175HIGHWindows Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2019-1177HIGHWindows Elevation of Privilege VulnerabilityEPSS 0.7%