Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-7329CRITICALPrivilege escalation in Progress MarkLogic Server REST query interfacesEPSS 0.6%CVE-2024-33552CRITICALWordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerabilityEPSS 0.6%CVE-2026-66015HIGHJFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.EPSS 0.6%CVE-2025-3278CRITICALUrbanGo Membership <= 1.0.4 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2026-73293HIGHSemaphore UI: Manager-to-owner privilege escalation via custom-role slug collisionEPSS 0.6%CVE-2025-29033HIGHAn issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parEPSS 0.6%CVE-2022-4270LOWIncorrect privilege assignment in M-Files Web ServerEPSS 0.6%CVE-2024-31498HIGHYubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windoEPSS 0.6%CVE-2024-41199HIGHAn issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to AdministratorEPSS 0.6%CVE-2024-7493CRITICALWPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User MetaEPSS 0.6%CVE-2025-22937CRITICALAn issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.EPSS 0.6%CVE-2025-57118CRITICALAn issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.phpEPSS 0.6%CVE-2022-46172MEDIUMauthentik allows existing authenticated users to create arbitrary accountsEPSS 0.6%CVE-2026-55485HIGHPiccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.EPSS 0.6%CVE-2024-27710CRITICALAn issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentiEPSS 0.6%CVE-2026-15103HIGHWPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path ParameterEPSS 0.6%CVE-2024-28391CRITICALSQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate EPSS 0.6%CVE-2024-3828HIGHSpectra Pro <= 1.1.5 - Authenticated (Author+) Privilege EscalationEPSS 0.6%CVE-2026-104768HIGHAutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' OptionEPSS 0.6%CVE-2024-2433MEDIUMPAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability LossEPSS 0.6%