Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-36213HIGHAn issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.EPSS 0.6%CVE-2026-36102HIGHAn issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privEPSS 0.6%CVE-2021-37911HIGHThe management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any syEPSS 0.6%CVE-2023-51425CRITICALWordPress Rencontre plugin <= 3.10.1 - Unauthenticated Account Takeover vulnerabilityEPSS 0.6%CVE-2024-29052HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-9192HIGHWP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta UpdateEPSS 0.6%CVE-2019-3786HIGHBBR could run arbitrary scripts on deployment VMsEPSS 0.6%CVE-2026-16337CRITICALImproper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms EPSS 0.6%CVE-2022-24072—The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store weEPSS 0.6%CVE-2025-53942HIGHauthentik has an insufficient check for account active status during OAuth/SAML authenticationEPSS 0.6%CVE-2026-75971HIGHShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' NodesEPSS 0.6%CVE-2026-12470HIGHCMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX ActionEPSS 0.6%CVE-2026-111708CRITICALWhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signupEPSS 0.6%CVE-2026-22039CRITICALKyverno Cross-Namespace Privilege Escalation via Policy apiCallEPSS 0.6%CVE-2026-16635HIGHPronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' FieldEPSS 0.6%CVE-2026-13228HIGHLatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' ParameterEPSS 0.6%CVE-2022-32907HIGHThis issue was addressed with improved checks. This issue is fixed in tvOS 16, iOS 16, watchOS 9. An app may be able to execute arbitrary coEPSS 0.6%CVE-2019-25068MEDIUMAxios Italia Axios RE Connection REDefault.aspx privileges managementEPSS 0.6%CVE-2026-85955CRITICALImproper privilege management in Progress MarkLogic Server xdmp:eval-inEPSS 0.6%CVE-2020-13519HIGHA privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/EPSS 0.6%