Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-15426HIGHAcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template UpdateEPSS 0.7%CVE-2026-92619HIGHBooking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' ParameterEPSS 0.7%CVE-2026-24072HIGHApache HTTP Server: mod_rewrite elevation of privileges via ap_exprEPSS 0.7%CVE-2017-20037MEDIUMSICUNET Access Controller privileges managementEPSS 0.7%CVE-2024-33308CRITICALAn issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the EmeEPSS 0.7%CVE-2023-21848HIGHVulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). TheEPSS 0.6%CVE-2024-27181HIGHApache Linkis Basic management services: Privilege Escalation Attack vulnerabilityEPSS 0.6%CVE-2025-29976HIGHMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-51546HIGHWordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerabilityEPSS 0.6%CVE-2026-85154CRITICALWWBN AVideo Authentication Bypass via Non-Expiring video_id_hashEPSS 0.6%CVE-2024-8853CRITICALWebo-facto <= 1.40 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2023-33972HIGHPrivilege escalation from having CREATE access on a keyspace in ScylladbEPSS 0.6%CVE-2024-8100HIGHOn affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.EPSS 0.6%CVE-2022-41948MEDIUMPrivilege Chaining with the user admin role in dhis2-coreEPSS 0.6%CVE-2026-2631CRITICALDatalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2026-75927HIGHPublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability GrantEPSS 0.6%CVE-2025-71421HIGHUVdesk core-framework before 1.1.7 Privilege Escalation via editAgentEPSS 0.6%CVE-2024-0439HIGHUser can manually send request at manager permission to modify system configurationsEPSS 0.6%CVE-2023-27094HIGHAn issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management moEPSS 0.6%CVE-2026-17553HIGHShopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX ActionEPSS 0.6%