Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-41666MEDIUMThe Argo CD web terminal session does not handle the revocation of user permissions properly.EPSS 0.7%CVE-2026-104745HIGHCustomer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' ParameterEPSS 0.7%CVE-2026-34528HIGHFile Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionEPSS 0.7%CVE-2022-43759HIGHRancher: Privilege escalation via promoted rolesEPSS 0.7%CVE-2023-28632HIGHGLPI vulnerable to account takeover by authenticated userEPSS 0.7%CVE-2024-43401CRITICALIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themEPSS 0.7%CVE-2023-36100—An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameterEPSS 0.7%CVE-2025-2798CRITICALWoffice <= 5.4.21 - Authentication Bypass via Registration RoleEPSS 0.7%CVE-2025-7851HIGHUnauthorized root access via debug functionalityEPSS 0.7%CVE-2023-21987HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PrioEPSS 0.7%CVE-2024-32003HIGHDusk plugin may allow unfettered user authentication in misconfigured installsEPSS 0.7%CVE-2023-37389HIGHWordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.7%CVE-2021-45729MEDIUMWordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerabilityEPSS 0.7%CVE-2026-44787HIGHDiscourse: Signup-time primary_group_id assignment grants whisperer accessEPSS 0.7%CVE-2022-31672MEDIUMVMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate EPSS 0.7%CVE-2025-0505CRITICALOn Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system stateEPSS 0.7%CVE-2023-41309—Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availabilitEPSS 0.7%CVE-2026-7641HIGHImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsEPSS 0.7%CVE-2026-33821HIGHMicrosoft Dynamics 365 Customer Insights Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-15426HIGHAcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template UpdateEPSS 0.7%