Weaknesses of type CWE-269

2,827 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2020-13515HIGHA privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A specially crafted I/EPSS 0.5%CVE-2020-13514HIGHA privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A speciallyEPSS 0.5%CVE-2020-13512HIGHA privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A speciallyEPSS 0.5%CVE-2023-43845CRITICALAten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account. The user is not asked to change the credentials EPSS 0.5%CVE-2020-13513HIGHA privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A speciallyEPSS 0.5%CVE-2026-113615CRITICALGS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLiEPSS 0.5%CVE-2024-12398HIGHAn improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) anEPSS 0.5%CVE-2024-25847CRITICALSQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6EPSS 0.5%CVE-2023-50726MEDIUMUsers with `create` but not `override` privileges can perform local sync in argo-cdEPSS 0.5%CVE-2020-13517MEDIUMAn information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0. A specially craftedEPSS 0.5%CVE-2022-37002HIGHThe SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applicationsEPSS 0.5%CVE-2022-35921LOWUser preference to prevent private discussions not respected in fof/byobuEPSS 0.5%CVE-2024-4545HIGHEDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldrEPSS 0.5%CVE-2025-15030CRITICALUser Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password ResetEPSS 0.5%CVE-2024-44893CRITICALAn issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET requeEPSS 0.5%CVE-2026-15982CRITICALAimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'EPSS 0.5%CVE-2026-15369CRITICALCustom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API CheckoutEPSS 0.5%CVE-2026-74985CRITICALPrivilege escalation in the Enterprise Policies componentEPSS 0.5%CVE-2023-47782HIGHWordPress Thrive Theme Builder theme < 3.24.0 - Authenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-47412HIGHpraisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}EPSS 0.5%