Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-37455HIGHWordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-1728CRITICALPrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account TakeoverEPSS 0.5%CVE-2023-44106—API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perforEPSS 0.5%CVE-2023-44105—Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cEPSS 0.5%CVE-2024-29150HIGHAn issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.0EPSS 0.5%CVE-2026-97644HIGHGroundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/testEPSS 0.5%CVE-2024-33872CRITICALKeyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of EPSS 0.5%CVE-2025-12882CRITICALClasifico Listing <= 2.0 - Unauthenticated Privilege EscalationEPSS 0.5%CVE-2022-42046HIGHwfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalationEPSS 0.5%CVE-2022-46327CRITICALSome smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in sEPSS 0.5%CVE-2023-47683HIGHWordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-101466HIGHVulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions thEPSS 0.5%CVE-2026-102676HIGHElectron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsEPSS 0.5%CVE-2022-48353CRITICALSome smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which resulEPSS 0.5%CVE-2026-52808HIGHGogs: Write-level collaborators can mutate admin-only repository settings via APIEPSS 0.5%CVE-2023-51479HIGHWordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-5566MEDIUMImproper Privilege Management allows for access to unauthorized repository content during migrationEPSS 0.5%CVE-2024-33550HIGHWordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2026-31070CRITICALThe LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigningEPSS 0.5%CVE-2023-47868HIGHWordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerabilityEPSS 0.5%