Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-47412HIGHpraisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}EPSS 0.5%CVE-2023-48319MEDIUMWordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-86553HIGHA password reset vulnerability in ZTE SmartLife APPEPSS 0.5%CVE-2026-76350HIGHImproper Privilege Management through PDF Attachments for Email Alert Actions in Splunk EnterpriseEPSS 0.5%CVE-2026-16904HIGHIBM i is Affected By improper privilege management in Navigator for iEPSS 0.5%CVE-2026-18713HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.5%CVE-2026-12144HIGHWholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' ParameterEPSS 0.5%CVE-2026-72886CRITICALDokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)EPSS 0.5%CVE-2026-14279HIGHWholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' ParameterEPSS 0.5%CVE-2026-15312HIGHPropovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' ParameterEPSS 0.5%CVE-2021-35309—An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.EPSS 0.5%CVE-2026-18950HIGHOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationEPSS 0.5%CVE-2026-73284HIGHRustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service AccountsEPSS 0.5%CVE-2021-38638HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-73305HIGHBudibase: Privilege escalation via public role assignment API missing app-level authorizationEPSS 0.5%CVE-2025-25962CRITICALAn issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition funcEPSS 0.5%CVE-2026-31852CRITICALJellyfin Possible Organization/Secret Compromise from dangerous CI implementationEPSS 0.5%CVE-2024-25343CRITICALTenda N300 F3 router vulnerability allows users to bypass intended security policy and create weak passwords.EPSS 0.5%CVE-2025-0180CRITICALWP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validationEPSS 0.5%CVE-2024-34146MEDIUMJenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, aEPSS 0.5%