Weaknesses of type CWE-269

2,793 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2022-26676CRITICALaEnrich a+HRD - Broken Access ControlEPSS 1.4%CVE-2020-8247—Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 1EPSS 1.4%CVE-2020-15368MEDIUMAsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via aEPSS 1.3%CVE-2023-6507MEDIUMGroups not dropped before running subprocess when using empty 'extra_groups' parameterEPSS 1.3%CVE-2024-31141MEDIUMApache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProviderEPSS 1.3%CVE-2026-7467HIGHRead More & Accordion <= 3.5.7 - Privilege Escalation via importDataEPSS 1.3%CVE-2022-43138CRITICALDolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.EPSS 1.3%CVE-2022-29218HIGHUnauthorized takeover for new versions of some platform-specific gemsEPSS 1.3%CVE-2019-25071MEDIUMApple iOS Siri Self privileges managementEPSS 1.3%CVE-2023-3467HIGHPrivilege Escalation to root administrator (nsroot) EPSS 1.3%CVE-2020-8021MEDIUMunauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build ServiceEPSS 1.3%CVE-2018-11614—This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. AnEPSS 1.3%CVE-2023-31062CRITICALApache InLong: Privilege escalation vulnerability for InLongEPSS 1.3%CVE-2026-85979HIGHCommand Injection in Puppet EnterpriseEPSS 1.3%CVE-2021-1400HIGHCisco Small Business 100, 300, and 500 Series Wireless Access Points VulnerabilitiesEPSS 1.3%CVE-2022-41032HIGHNuGet Client Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2024-8533HIGHRockwell Automation OptixPanel™ Privilege Escalation Vulnerability via File PermissionsEPSS 1.3%CVE-2017-0934—Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection ofEPSS 1.3%CVE-2020-8258—Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15EPSS 1.3%CVE-2026-8206CRITICALKirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'EPSS 1.3%