Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2025-40538CRITICALSolarWinds Serv-U Broken Access Control Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-29166—A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate prEPSS 0.6%CVE-2024-55949CRITICALPrivilege escalation in IAM import API in MinIOEPSS 0.6%CVE-2024-29667CRITICALSQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate priEPSS 0.6%CVE-2021-34487HIGHWindows Event Tracing Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-1908MEDIUMImproper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege EscalationEPSS 0.6%CVE-2026-59799HIGHApache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable FlowEPSS 0.6%CVE-2024-27518HIGHAn issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a cEPSS 0.6%CVE-2024-9941HIGHWPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2022-33640HIGHSystem Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-44076CRITICALIn Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.EPSS 0.6%CVE-2026-75160CRITICALAn issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgiEPSS 0.6%CVE-2026-18550CRITICALNokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' ParameterEPSS 0.6%CVE-2026-13355CRITICALMeta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' ParameterEPSS 0.6%CVE-2022-20739HIGHCisco SD-WAN vManage Software Privilege Escalation VulnerabilityEPSS 0.6%CVE-2026-77524CRITICALKEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationEPSS 0.6%CVE-2026-52533CRITICALAn issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component fileEPSS 0.6%CVE-2026-77439HIGHImmich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpointsEPSS 0.6%CVE-2021-23265LOWImproper Privilege Management in Crafter StudioEPSS 0.6%CVE-2026-59245HIGHApache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)EPSS 0.6%