Weaknesses of type CWE-269

2,507 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-83271HIGHVulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0EPSS 0.4%CVE-2026-83306HIGHVulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). Supported versions that EPSS 0.4%CVE-2024-31237HIGHWordPress s2Member plugin <= 240315 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-87165HIGHVulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: ECC For Award andEPSS 0.4%CVE-2026-83340HIGHVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affecteEPSS 0.4%CVE-2026-83338HIGHVulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported vEPSS 0.4%CVE-2026-87150HIGHVulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are EPSS 0.4%CVE-2026-87162HIGHVulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). SuppoEPSS 0.4%CVE-2026-83212HIGHVulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are afEPSS 0.4%CVE-2026-72534HIGHAuthentik Security authentik - Privilege EscalationEPSS 0.4%CVE-2026-53527HIGHLeafWiki Vulnerable to Privilege Escalation via User Self-Service UpdateEPSS 0.4%CVE-2026-83148HIGHVulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability alEPSS 0.4%CVE-2026-83121HIGHVulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12EPSS 0.4%CVE-2026-83282CRITICALVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The suppoEPSS 0.4%CVE-2026-83194HIGHVulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aEPSS 0.4%CVE-2026-83168HIGHVulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported vEPSS 0.4%CVE-2026-87759HIGHAdd User Autocomplete < 1.2 - Subscriber+ Privilege EscalationEPSS 0.4%CVE-2026-83120HIGHVulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affectedEPSS 0.4%CVE-2026-83335HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported vEPSS 0.4%CVE-2026-83348HIGHVulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0EPSS 0.4%