Weaknesses of type CWE-269

2,490 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-17553HIGHShopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX ActionEPSS 0.4%CVE-2025-71421HIGHUVdesk core-framework before 1.1.7 Privilege Escalation via editAgentEPSS 0.4%CVE-2025-36729HIGHRACOM M!DGE2 Privilege Escalation via SDK Testing EndpointEPSS 0.4%CVE-2024-8810HIGHPrivilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write accessEPSS 0.4%CVE-2026-39386HIGHNeko has Self-service Privilege Escalation for Authenticated UsersEPSS 0.4%CVE-2026-45395HIGHOpen WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code ExecutionEPSS 0.4%CVE-2025-21199MEDIUMAzure Agent Installer for Backup and Site Recovery Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-51392HIGHAn issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php componentEPSS 0.4%CVE-2024-33226CRITICALAn issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and eEPSS 0.4%CVE-2025-5931HIGHDokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege EscalationEPSS 0.4%CVE-2026-61176MEDIUMVulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported verEPSS 0.4%CVE-2019-13690CRITICALInappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilegEPSS 0.4%CVE-2022-23485MEDIUMInvite code reuse via cookie manipulation in sentryEPSS 0.4%CVE-2020-7335HIGHPrivilege Escalation vulnerability in McAfee Total Protection (MTP)EPSS 0.4%CVE-2016-15045HIGHDeepin lastore-daemon Privilege Escalation via Unsigned .deb InstallationEPSS 0.4%CVE-2024-0197HIGHPrivilege Escalation in Thales SafeNet Sentinel HASP LDKEPSS 0.4%CVE-2026-61076CRITICALVulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). The suppoEPSS 0.4%CVE-2026-60663CRITICALVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.4%CVE-2023-36721HIGHWindows Error Reporting Service Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-87179HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.4%