Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-87246HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.5%CVE-2026-87214CRITICALVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.5%CVE-2026-60836HIGHVulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versionsEPSS 0.5%CVE-2026-60418HIGHVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affectEPSS 0.5%CVE-2026-60925HIGHVulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions tEPSS 0.5%CVE-2022-35762HIGHStorage Spaces Direct Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-60900HIGHVulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Rapid Implementation). Supported verEPSS 0.5%CVE-2026-61107HIGHVulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that aEPSS 0.5%CVE-2026-62548HIGHVulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affeEPSS 0.5%CVE-2026-83482HIGHVulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affeEPSS 0.5%CVE-2026-83440HIGHVulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are afEPSS 0.5%CVE-2022-27659MEDIUMOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated aEPSS 0.5%CVE-2024-8247HIGHNewsletters <= 4.9.9.2 - Authenticated Privilege EscalationEPSS 0.5%CVE-2024-6482HIGHLogin with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege EscalationEPSS 0.5%CVE-2016-15045HIGHDeepin lastore-daemon Privilege Escalation via Unsigned .deb InstallationEPSS 0.5%CVE-2025-37123HIGHAuthenticated Command Injection leads to Unauthorized Actions in CLI InterfaceEPSS 0.5%CVE-2026-86275MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges managementEPSS 0.5%CVE-2026-73122HIGHMulticloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespacesEPSS 0.5%CVE-2024-37455HIGHWordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-1728CRITICALPrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account TakeoverEPSS 0.5%