Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2023-41808HIGHArbitrary File Read As Root Via GoTTY PageEPSS 0.5%CVE-2024-34146MEDIUMJenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, aEPSS 0.5%CVE-2023-33327HIGHWordPress Leyka plugin <= 3.30.2 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2023-50921CRITICALAn issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privEPSS 0.5%CVE-2023-36496HIGHDelegated Admin Virtual Attribute Provider Privilege EscalationEPSS 0.5%CVE-2022-3068MEDIUMImproper Privilege Management in octoprint/octoprintEPSS 0.5%CVE-2023-4607HIGHAn authenticated XCC user can change permissions for any user through a crafted API command.EPSS 0.5%CVE-2026-8980CRITICALPrivilege EscalationEPSS 0.5%CVE-2023-46771HIGHSecurity vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.5%CVE-2020-13516MEDIUMAn information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144 functionality of NZXT CAM 4.8.0. A specially craftedEPSS 0.5%CVE-2020-13518MEDIUMAn information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0. A specially craftedEPSS 0.5%CVE-2020-13511MEDIUMAn information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specialEPSS 0.5%CVE-2024-43403HIGHKanister has a potential risk which can be leveraged to make a cluster-level privilege escalationEPSS 0.5%CVE-2026-94609HIGHauthentik: Privilege Escalation to Superuser via Group HierarchyEPSS 0.5%CVE-2026-14956CRITICALBricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds ParameterEPSS 0.5%CVE-2026-12793CRITICALJetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' ParameterEPSS 0.5%CVE-2026-9055CRITICALBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'EPSS 0.5%CVE-2026-113947HIGHThis issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted aEPSS 0.5%CVE-2026-84795CRITICALCraft CMS before 5.10.11 Authentication Bypass via Admin Flag InheritanceEPSS 0.5%CVE-2020-35517—A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest usEPSS 0.5%