Weaknesses of type CWE-269

2,793 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2022-24812HIGHFGAC API Key privilege escalation in GrafanaEPSS 2.4%CVE-2024-21324HIGHMicrosoft Defender for IoT Elevation of Privilege VulnerabilityEPSS 2.3%CVE-2023-39335—A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impEPSS 2.3%CVE-2018-13799—A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data pointEPSS 2.3%CVE-2017-0358HIGHntfs-3g: Modprobe influence vulnerability via environment variablesEPSS 2.2%CVE-2022-24842HIGHImproper Privilege Management in MinIOEPSS 2.1%CVE-2022-35774MEDIUMAzure Site Recovery Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2026-12394CRITICALMemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to AdministratorEPSS 2.1%CVE-2021-1401HIGHCisco Small Business 100, 300, and 500 Series Wireless Access Points VulnerabilitiesEPSS 2.0%CVE-2023-30765HIGH​Delta Electronics InfraSuite Device Master Improper Access ControlEPSS 2.0%CVE-2022-41923CRITICALGrails Spring Security Core plugin vulnerable to privilege escalationEPSS 1.9%CVE-2021-29449MEDIUMMultiple Privilege Escalation Vulnerabilities PiholeEPSS 1.8%CVE-2022-35775MEDIUMAzure Site Recovery Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2022-35781MEDIUMAzure Site Recovery Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2022-35780MEDIUMAzure Site Recovery Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2022-35782MEDIUMAzure Site Recovery Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2015-10139HIGHWPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege EscalationEPSS 1.8%CVE-2023-32559HIGHA privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use EPSS 1.8%CVE-2024-21111HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PrioEPSS 1.8%CVE-2020-27655MEDIUMImproper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resourEPSS 1.8%