Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-13439CRITICALEasy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST EndpointEPSS 0.7%CVE-2022-31039MEDIUMImproper privilege management - Anyone can view room settings in GreenLightEPSS 0.7%CVE-2021-34579HIGHPHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege ManagementEPSS 0.7%CVE-2023-39740—The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadEPSS 0.7%CVE-2023-39732—The leakage of the client secret in Tokueimaru_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broaEPSS 0.7%CVE-2023-46145HIGHWordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerabilityEPSS 0.7%CVE-2023-2240HIGHImproper Privilege Management in microweber/microweberEPSS 0.7%CVE-2026-75983HIGHEventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap FilterEPSS 0.7%CVE-2023-39733—The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast mEPSS 0.7%CVE-2026-15017HIGHMDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' HandlersEPSS 0.7%CVE-2022-39007CRITICALThe location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privileEPSS 0.7%CVE-2023-6218HIGHMOVEit Transfer Group Admin Privilege EscalationEPSS 0.7%CVE-2026-32760CRITICALFile Browser Self Registration Grants Any User Admin Access When Default Permissions Include AdminEPSS 0.7%CVE-2023-23990HIGHWordPress Redirection for Contact Form 7 plugin <= 2.7.0 - Privilege Escalation vulnerabilityEPSS 0.7%CVE-2025-34204HIGHVasion Print (formerly PrinterLogic) Processes Running as Root Inside Docker InstancesEPSS 0.7%CVE-2026-65595HIGHn8n before 2.29.8 and 2.30.1 Privilege Escalation via Token ExchangeEPSS 0.7%CVE-2026-15001HIGHbLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL SettingsEPSS 0.7%CVE-2026-19883HIGHWPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_actionEPSS 0.7%CVE-2023-7090MEDIUMSudo: improper handling of ipa_hostname leads to privilege mismanagementEPSS 0.7%CVE-2024-24778MEDIUMApache StreamPipes: Resources Permission EscalationEPSS 0.7%