Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-31290CRITICALWordPress Demo My WordPress plugin <= 1.0.9.1 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-71625CRITICALAn issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php componentEPSS 0.5%CVE-2024-33567CRITICALWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2025-70888CRITICALAn issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c componEPSS 0.5%CVE-2024-32511CRITICALWordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2022-44689HIGHWindows Subsystem for Linux (WSL2) Kernel Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-90523MEDIUMjaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges managementEPSS 0.5%CVE-2026-16256CRITICALPouco Import Users <= 1.0.0 - Unauthenticated Privilege EscalationEPSS 0.5%CVE-2026-75860CRITICALJSON Options <= 0.0.4 - Unauthenticated Arbitrary Options UpdateEPSS 0.5%CVE-2026-76670CRITICALAuthorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN OrchestratorEPSS 0.5%CVE-2026-85681CRITICALWP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option UpdateEPSS 0.5%CVE-2026-76669CRITICALAuthorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN OrchestratorEPSS 0.5%CVE-2026-78362CRITICALSEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key AuthenticationEPSS 0.5%CVE-2026-18366CRITICALEvents Manager < 7.4.1 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-16298CRITICALFoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password ResetEPSS 0.5%CVE-2026-16722HIGHIBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []EPSS 0.5%CVE-2026-10522CRITICALSimple User Registration <= 6.9 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-16259CRITICALUix UserCenter <= 1.0.3 - Unauthenticated Privilege EscalationEPSS 0.5%CVE-2026-9810CRITICALAI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuthEPSS 0.5%CVE-2026-13598CRITICALRestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.5%