Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-72829HIGHGrav before 1.0.13 API Key Scope Bypass via UsersControllerEPSS 0.5%CVE-2026-15630CRITICALCVE-2026-15630EPSS 0.5%CVE-2026-72833HIGHGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API KeysEPSS 0.5%CVE-2026-61463HIGHShiori Authenticated Privilege Escalation via PATCH /api/v1/auth/accountEPSS 0.5%CVE-2025-5954CRITICALService Finder SMS System <= 2.0.0 - Unauthenticated Privilege EscalationEPSS 0.5%CVE-2026-117468MEDIUMDevice-code claim permits restricted token escalation in Psono ServerEPSS 0.5%CVE-2024-28905HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-6994CRITICALReveal Listing <= 3.3 - Unauthenticated Privilege EscalationEPSS 0.5%CVE-2022-35763HIGHStorage Spaces Direct Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2022-35764HIGHStorage Spaces Direct Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-117981CRITICALPrivilege escalation in the Toolkit componentEPSS 0.5%CVE-2022-35765HIGHStorage Spaces Direct Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2023-22645HIGHkubewarden: Excessive permissions for kubewarden-controller-manager-cluster-roleEPSS 0.5%CVE-2026-60439HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2024-29975MEDIUM** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versiEPSS 0.5%CVE-2026-17276CRITICALIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.5%CVE-2026-76687HIGHAuthenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN OrchestratorEPSS 0.5%CVE-2026-60373HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-60369CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-61246HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%