Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-13598CRITICALRestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-85681CRITICALWP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option UpdateEPSS 0.5%CVE-2026-116624HIGHAdvanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password FormEPSS 0.5%CVE-2026-90856MEDIUMSourceCodester College Notes Gallery Management System Registration Flow signup.php privileges managementEPSS 0.5%CVE-2026-26725CRITICALAn issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AEPSS 0.5%CVE-2026-14719MEDIUMSourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges managementEPSS 0.5%CVE-2026-75837CRITICALGrav before 2.0.14 Privilege Escalation via Group Access FieldEPSS 0.5%CVE-2025-6254CRITICALDoctreat Core <= 1.6.8 - Unauthenticated Privilege EscalationEPSS 0.5%CVE-2026-7284CRITICALEasy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_registerEPSS 0.5%CVE-2024-22774HIGHAn issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exEPSS 0.5%CVE-2025-64338MEDIUMClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection NameEPSS 0.5%CVE-2026-2563MEDIUMJingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges managementEPSS 0.5%CVE-2026-105126HIGHLaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role TamperingEPSS 0.5%CVE-2024-28904HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-72828HIGHGrav before 1.0.13 API Key Scope Bypass via InvitationsControllerEPSS 0.5%CVE-2026-24894HIGHFrankenPHP leaks session data between requests in worker modeEPSS 0.5%CVE-2026-68752HIGHProject Resource Managers may escalate privileges in JFrog ArtifactoryEPSS 0.5%CVE-2020-13509MEDIUMAn information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specialEPSS 0.5%CVE-2023-30617MEDIUMLeverage the kruise-daemon pod to list all secrets in the entire clusterEPSS 0.5%CVE-2026-110535HIGHApache Syncope: AuthProfile value escalation via self-service updateEPSS 0.5%