Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2025-66428HIGHAn issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.EPSS 0.5%CVE-2023-28436MEDIUMNon-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled processEPSS 0.5%CVE-2026-8709CRITICALPrivilege escalation in Progress MarkLogic Server REST document patch operationEPSS 0.5%CVE-2023-20598HIGH An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gainEPSS 0.5%CVE-2026-42609HIGHGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite LogicEPSS 0.5%CVE-2025-44040HIGHAn issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication dEPSS 0.5%CVE-2026-9193CRITICALPrivilege escalation in Progress MarkLogic Server Hadoop integrationEPSS 0.5%CVE-2026-101519HIGHVulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions thEPSS 0.5%CVE-2026-83325HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported EPSS 0.5%CVE-2026-75796HIGHAI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User ToolsEPSS 0.5%CVE-2026-81810HIGHAll-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key DisclosureEPSS 0.5%CVE-2026-80071HIGHUser Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorEPSS 0.5%CVE-2026-83344HIGHVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). SupportEPSS 0.5%CVE-2026-83322HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported EPSS 0.5%CVE-2026-83195HIGHVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affEPSS 0.5%CVE-2026-81431HIGHRegistration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_idEPSS 0.5%CVE-2026-83176HIGHVulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported veEPSS 0.5%CVE-2026-92540HIGHImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_usersEPSS 0.5%CVE-2026-83328HIGHVulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions thatEPSS 0.5%CVE-2026-70421HIGHDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Privilege Management vulnerability. A high privileged attacker witEPSS 0.5%