Weaknesses of type CWE-269

2,507 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2026-62456HIGHVulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affeEPSS 0.3%CVE-2026-33706HIGHChamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)EPSS 0.3%CVE-2025-56747MEDIUMCreativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regulEPSS 0.3%CVE-2024-38818MEDIUMVMware NSX contains a local privilege escalation vulnerability.  An authenticated malicious actor may exploit this vulnerability to obtain EPSS 0.3%CVE-2025-64336HIGHClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo TitleEPSS 0.3%CVE-2021-23882HIGHImproper Access Control in the ENS installerEPSS 0.3%CVE-2022-22187HIGHJIMS: Local Privilege Escalation vulnerability via repair functionalityEPSS 0.3%CVE-2026-75845MEDIUMArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_settingEPSS 0.3%CVE-2020-3595HIGHCisco SD-WAN Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2020-3593HIGHCisco SD-WAN Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-73973MEDIUMLinuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)EPSS 0.3%CVE-2025-46576MEDIUMZTE GoldenDB Database product has a privilege escalation vulnerabilityEPSS 0.3%CVE-2020-3600HIGHCisco SD-WAN Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2020-3594HIGHCisco SD-WAN Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-17074LOWIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.3%CVE-2026-33074MEDIUMDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptionsEPSS 0.3%CVE-2026-45254MEDIUMIncorrect libcap_net limitation list manipulationEPSS 0.3%CVE-2022-20239MEDIUMremap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can alsoEPSS 0.3%CVE-2026-79276MEDIUMImproper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering EPSS 0.3%CVE-2024-23276HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An EPSS 0.3%