Weaknesses of type CWE-269

2,829 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2024-45373HIGHDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege ManagementEPSS 0.4%CVE-2026-85948CRITICALImproper privilege management in Progress MarkLogic Server Management APIEPSS 0.4%CVE-2026-93968MEDIUMaiyiyi121 SxDevOps UserSerializer serializers.py update privileges managementEPSS 0.4%CVE-2024-10203HIGHAgent Arbitrary File DeletionEPSS 0.4%CVE-2024-32960HIGHWordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2023-5214MEDIUMCVE-2023-5214 - Privilege Escalation in Puppet Bolt EPSS 0.4%CVE-2025-34251HIGHTesla Telematics Control Unit (TCU) < v2025.14 Authentication BypassEPSS 0.4%CVE-2026-93017HIGHInsights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-readerEPSS 0.4%CVE-2025-21199MEDIUMAzure Agent Installer for Backup and Site Recovery Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-26416HIGHAn authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privilegeEPSS 0.4%CVE-2023-29056MEDIUMA valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC mustEPSS 0.4%CVE-2023-41312—Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated aEPSS 0.4%CVE-2024-39634HIGHWordPress PowerPack Pro for Elementor plugin <= 2.10.14 - Contributor+ Privilege Escalation vulnerabilityEPSS 0.4%CVE-2024-27711HIGHAn issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up pEPSS 0.4%CVE-2024-37484HIGHWordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-6228HIGHFrontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User FormEPSS 0.4%CVE-2024-13058MEDIUMAuthenticated, non-admin users can create storage pools via the sifi APIEPSS 0.4%CVE-2024-37952HIGHWordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-13756HIGHWP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' ParameterEPSS 0.4%CVE-2026-14359HIGHYITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_userEPSS 0.4%