Weaknesses of type CWE-269

2,490 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-6750HIGHPrivilege escalation in the Graphics: WebRender componentEPSS 0.5%CVE-2025-70888CRITICALAn issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c componEPSS 0.5%CVE-2024-33872CRITICALKeyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of EPSS 0.5%CVE-2022-35762HIGHStorage Spaces Direct Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-65595HIGHn8n before 2.29.8 and 2.30.1 Privilege Escalation via Token ExchangeEPSS 0.5%CVE-2025-57760HIGHLangflow Vulnerable to Privilege Escalation via CLI Superuser CreationEPSS 0.5%CVE-2023-47683HIGHWordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-52808HIGHGogs: Write-level collaborators can mutate admin-only repository settings via APIEPSS 0.5%CVE-2022-48353CRITICALSome smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which resulEPSS 0.5%CVE-2022-27659MEDIUMOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated aEPSS 0.5%CVE-2026-73470CRITICALApache Syncope: Delegating users can grant unowned RolesEPSS 0.5%CVE-2023-46758—Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service EPSS 0.5%CVE-2026-31070CRITICALThe LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigningEPSS 0.5%CVE-2024-5566MEDIUMImproper Privilege Management allows for access to unauthorized repository content during migrationEPSS 0.5%CVE-2023-51479HIGHWordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-33550HIGHWordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2023-47868HIGHWordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-43245CRITICALWordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2024-43311CRITICALWordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2023-41806HIGHMisassignment of privileges can cause DOS attackEPSS 0.5%