Weaknesses of type CWE-269

2,502 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-83322HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported EPSS 0.5%CVE-2026-83453HIGHVulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). SuppEPSS 0.5%CVE-2026-31834HIGHUmbraco Affected by Vertical Privilege Escalation via Missing Authorization ChecksEPSS 0.5%CVE-2026-83344HIGHVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). SupportEPSS 0.5%CVE-2026-83268CRITICALVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affecteEPSS 0.5%CVE-2026-17533HIGHAll-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST ImportEPSS 0.5%CVE-2026-83176HIGHVulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported veEPSS 0.5%CVE-2026-83117HIGHVulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected arEPSS 0.5%CVE-2026-81445HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privilegedEPSS 0.5%CVE-2026-79996HIGHUser Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login SettingsEPSS 0.5%CVE-2026-92541HIGHImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend ImporterEPSS 0.5%CVE-2026-74925HIGHMultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-80071HIGHUser Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-44787HIGHDiscourse: Signup-time primary_group_id assignment grants whisperer accessEPSS 0.5%CVE-2020-13776MEDIUMsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated byEPSS 0.5%CVE-2023-20598HIGH An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gainEPSS 0.5%CVE-2026-56245HIGHSupabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPCEPSS 0.5%CVE-2026-14960CRITICALCVE-2026-14960EPSS 0.5%CVE-2023-36628HIGHPrivilege Escalation in VASAEPSS 0.5%CVE-2024-1138HIGHTIBCO FTL Privilege EscalationEPSS 0.5%