Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-59245HIGHApache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)EPSS 0.6%CVE-2026-65831HIGHArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file readEPSS 0.6%CVE-2025-12485HIGHImproper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonateEPSS 0.6%CVE-2022-26795HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-23093HIGHThe Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authentEPSS 0.6%CVE-2024-35430HIGHIn ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data froEPSS 0.6%CVE-2022-3641HIGHElevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated useEPSS 0.6%CVE-2024-31502HIGHAn issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /adEPSS 0.6%CVE-2026-16149HIGHSecurity Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback OverwriteEPSS 0.6%CVE-2024-45041HIGHExternal Secrets Operator vulnerable to privilege escalationEPSS 0.6%CVE-2024-3325HIGHJasperReports Server Driver upload vulnerabilityEPSS 0.6%CVE-2020-8290—Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack EPSS 0.6%CVE-2024-21622MEDIUMCraft CMS Privilege EscalationEPSS 0.6%CVE-2026-14482HIGH多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' ParametersEPSS 0.6%CVE-2026-18322HIGHSmart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.6%CVE-2026-54168MEDIUMPipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolutionEPSS 0.6%CVE-2024-3470MEDIUMRepository administrator can bypass organization's ruleset using deploy keysEPSS 0.6%CVE-2026-76742CRITICALAuthentication Bypass in the Web Management Interface of AOS-SEPSS 0.6%CVE-2023-46758—Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service EPSS 0.6%CVE-2026-36213HIGHAn issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.EPSS 0.6%