Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-73470CRITICALApache Syncope: Delegating users can grant unowned RolesEPSS 0.5%CVE-2024-33549HIGHWordPress WZone plugin <= 14.0.10 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2022-45451HIGHLocal privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber ProtectEPSS 0.5%CVE-2026-37071CRITICALArbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authentEPSS 0.5%CVE-2020-35517—A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest usEPSS 0.5%CVE-2026-82857CRITICALhulumi before v1.3.2 Privilege Escalation via IAM PolicyEPSS 0.5%CVE-2026-60566CRITICALVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are afEPSS 0.5%CVE-2026-60532CRITICALVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft Applications). Supported EPSS 0.5%CVE-2026-61154CRITICALVulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version EPSS 0.5%CVE-2026-73664HIGHFreePBX: Authenticated Arbitrary SSH Key Injection via Backup ModuleEPSS 0.5%CVE-2024-33569HIGHWordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-15992HIGHWP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.5%CVE-2026-68561HIGHWekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow ruleEPSS 0.5%CVE-2024-37665HIGHAn access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST reqEPSS 0.5%CVE-2026-59797CRITICALApache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-functionEPSS 0.5%CVE-2025-1295HIGHTemplines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.5%CVE-2026-4880CRITICALBarcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token AuthenticationEPSS 0.5%CVE-2023-36569HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2022-1606LOWIncorrect privilege assignment in M-Files ServerEPSS 0.5%CVE-2019-15789HIGHMicrok8s Privilege Escalation VulnerabilityEPSS 0.5%