Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2012-10022HIGHKloxo <= 6.1.12 Local Privilege EscalationEPSS 0.5%CVE-2025-52289HIGHA Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafEPSS 0.5%CVE-2024-43311CRITICALWordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2024-43245CRITICALWordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2026-101860HIGHRaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges managementEPSS 0.5%CVE-2023-41806HIGHMisassignment of privileges can cause DOS attackEPSS 0.5%CVE-2022-39422HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorEPSS 0.5%CVE-2026-48010MEDIUMShopware: Privilege escalation: non-admin user with user:create ACL can create admin accountsEPSS 0.5%CVE-2022-48284CRITICALA piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnEPSS 0.5%CVE-2024-0003CRITICALA condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the arrayEPSS 0.5%CVE-2026-84115MEDIUMCleo Harmony JWT Refresh Token connections privileges managementEPSS 0.5%CVE-2022-48283CRITICALA piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnEPSS 0.5%CVE-2025-33067HIGHWindows Task Scheduler Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-8176HIGHLatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password ResetEPSS 0.5%CVE-2023-47629HIGHPrivilege escalation through email sign-up in datahubEPSS 0.5%CVE-2026-104798CRITICALMy Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' AttributeEPSS 0.5%CVE-2024-39206HIGHAn issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup dueEPSS 0.5%CVE-2026-64637CRITICALImproper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessiEPSS 0.5%CVE-2024-33223HIGHAn issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute EPSS 0.5%CVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.5%