Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-82860CRITICAL@hulumi/policies before 1.3.2 Admin Policy BypassEPSS 0.5%CVE-2023-51483CRITICALWordPress WP Frontend Profile plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2020-16126LOWaccountsservice drops ruid, allows unprivileged users to send it signalsEPSS 0.5%CVE-2026-76677HIGHAuthorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN GatewaysEPSS 0.5%CVE-2026-104749HIGHBit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field DataEPSS 0.5%CVE-2026-55843HIGHSnipe-IT: Improper Privilege ManagementEPSS 0.5%CVE-2025-54594CRITICALreact-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltrationEPSS 0.5%CVE-2025-46116HIGHAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.EPSS 0.5%CVE-2025-57760HIGHLangflow Vulnerable to Privilege Escalation via CLI Superuser CreationEPSS 0.5%CVE-2024-33374CRITICALIncorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal withEPSS 0.5%CVE-2026-90787MEDIUMSoarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges managementEPSS 0.5%CVE-2023-51476CRITICALWordPress WP MLM Unilevel plugin <= 4.0 - Unauthenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2026-76694MEDIUMAuthenticated Privilege Escalation Vulnerability in the Command Line Interface of HPE Networking EdgeConnect SD-WAN GatewaysEPSS 0.5%CVE-2024-30542CRITICALWordPress WholesaleX plugin <= 1.3.2 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2023-51481CRITICALWordPress Local Delivery Drivers for WooCommerce plugin <= 1.9.0 - Unauthenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2026-51119CRITICALAn issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser componentsEPSS 0.5%CVE-2022-25311HIGHA vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All EPSS 0.5%CVE-2026-92957CRITICALvm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: PrefixEPSS 0.5%CVE-2024-38770CRITICALWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.20 - Authentication Bypass and Privilege Escalation VulnerabilityEPSS 0.5%CVE-2026-119075CRITICALRegistration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at CheckoutEPSS 0.5%