Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-48730MEDIUMThe default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authenticatiEPSS 0.6%CVE-2023-47132CRITICALAn issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.EPSS 0.6%CVE-2026-23663HIGHMicrosoft Global Secure Access (GSA) Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-12981HIGHCAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password ResetEPSS 0.6%CVE-2024-0353HIGHLocal privilege escalation in Windows productsEPSS 0.6%CVE-2026-72863CRITICALDokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hostEPSS 0.6%CVE-2024-36077HIGHQlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attackEPSS 0.6%CVE-2026-76713HIGHAuthenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)EPSS 0.6%CVE-2022-4264MEDIUMIncorrect privilege assignment in M-Files Web ServerEPSS 0.5%CVE-2024-25842HIGHAn issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop EPSS 0.5%CVE-2024-57778HIGHAn issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from stEPSS 0.5%CVE-2026-60372CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-60367CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-60366CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2023-50890HIGHWordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2023-51398HIGHWordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.14 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-40172HIGHauthentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuserEPSS 0.5%CVE-2026-73802HIGHGitea Runner host isolation bypass through container optionsEPSS 0.5%CVE-2025-52915HIGHK7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminEPSS 0.5%CVE-2022-42855HIGHA logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOSEPSS 0.5%