Weaknesses of type CWE-269

2,509 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-44543HIGHLocal Path Provisioner: HelperPod Template InjectionEPSS 0.4%CVE-2026-86195HIGHgrav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super FlagEPSS 0.4%CVE-2026-88863HIGHcapgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_orgEPSS 0.4%CVE-2023-47837HIGHWordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerabilityEPSS 0.4%CVE-2025-24353MEDIUMDirectus privilege escalation vulnerability using Share featureEPSS 0.4%CVE-2024-6286HIGHLocal Privilege escalation allows a low-privileged user to gain SYSTEM privilegesEPSS 0.4%CVE-2024-2432MEDIUMGlobalProtect App: Local Privilege Escalation (PE) VulnerabilityEPSS 0.4%CVE-2017-20121HIGHTeradici Management Console Database Management privileges managementEPSS 0.4%CVE-2026-92958HIGHvm2 before 3.11.7 Denylist Bypass via fs/promisesEPSS 0.4%CVE-2020-15797—A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers EPSS 0.4%CVE-2025-2238HIGHVikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'EPSS 0.4%CVE-2023-4976CRITICALFlashBlade Authentication Mechanism VulnerabilityEPSS 0.4%CVE-2026-12251HIGHUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldEPSS 0.4%CVE-2026-86814HIGHUsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider EmailEPSS 0.4%CVE-2026-15368HIGHProfile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After RegistrationEPSS 0.4%CVE-2026-85530HIGHGiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization MismatchEPSS 0.4%CVE-2026-11961HIGHUser Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership IDEPSS 0.4%CVE-2026-1994CRITICALs2Member <= 260127 - Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.4%CVE-2026-13142HIGHPasswordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute ForceEPSS 0.4%CVE-2026-18039HIGHEssential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass AssignmentEPSS 0.4%