Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-21892HIGHOn Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running withEPSS 0.6%CVE-2026-33509HIGHpyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script ConfigurationEPSS 0.6%CVE-2026-73269CRITICALCluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local saEPSS 0.6%CVE-2023-36628HIGHPrivilege Escalation in VASAEPSS 0.6%CVE-2024-30007HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-0242HIGHInsufficient permission check in the VQL copy() functionEPSS 0.6%CVE-2024-38775HIGHWordPress CTX Feed plugin <= 6.5.6 - Arbitrary Options Update vulnerabilityEPSS 0.6%CVE-2024-27811CRITICALThe issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, wEPSS 0.6%CVE-2024-11721HIGHFrontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2023-6793LOWPAN-OS: XML API Keys Revoked by Read-Only PAN-OS AdministratorEPSS 0.6%CVE-2026-79744HIGHMCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security ConfigurationEPSS 0.6%CVE-2024-22264HIGHVMware Avi Load Balancer updates address multiple vulnerabilitiesEPSS 0.6%CVE-2025-21287HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-12736HIGHWPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST EndpointEPSS 0.6%CVE-2023-48757HIGHWordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerabilityEPSS 0.6%CVE-2023-51356HIGHWordPress ARMember plugin <= 4.0.10 - Privilege Escalation vulnerabilityEPSS 0.6%CVE-2023-32196HIGHRancher's External RoleTemplates can lead to privilege escalationEPSS 0.6%CVE-2025-4315HIGHCubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2026-2144HIGHMagic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File StorageEPSS 0.6%CVE-2025-2232CRITICALRealteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'EPSS 0.6%