Weaknesses of type CWE-269

2,515 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2025-5496LOWArbitrary File DeletionEPSS 0.3%CVE-2021-1371MEDIUMCisco IOS XE SD-WAN Software Console Privilege Escalation VulnerabilityEPSS 0.3%CVE-2022-1823HIGHMcAfee MCPR privilege escalationEPSS 0.3%CVE-2020-26181HIGHDell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SEPSS 0.3%CVE-2020-7324MEDIUMImproper Access Control vulnerability in MVISION EndpointEPSS 0.3%CVE-2021-33526HIGHPrivilege escalation in mbDIALUP <= 3.9R0.0EPSS 0.3%CVE-2024-47770MEDIUMAbility to view Agent list with no privilege access in wazuh-dashboardEPSS 0.3%CVE-2025-66315MEDIUMZTE MF258K Pro Version Server has a Configuration Defect VulnerabilityEPSS 0.3%CVE-2024-28851MEDIUMElevation of privilege in Snowflake Hive MetaStore Connector Helper scriptEPSS 0.3%CVE-2026-100620MEDIUMCapgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service AccountEPSS 0.3%CVE-2021-31833HIGHPotential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally loggEPSS 0.3%CVE-2024-56447HIGHVulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affecEPSS 0.3%CVE-2026-55226MEDIUMStrimzi: Unrestricted access to all Secrets within namespace watched by the Topic operatorEPSS 0.3%CVE-2021-25336LOWImproper access control in NotificationManagerService in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applicationEPSS 0.2%CVE-2026-16772HIGHCVE-2026-16772EPSS 0.2%CVE-2021-37942HIGHAPM Java Agent Local Privilege EscalationEPSS 0.2%CVE-2020-16238MEDIUMB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusEPSS 0.2%CVE-2025-3224HIGHElevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory DeletionEPSS 0.2%CVE-2026-13415HIGHCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settingsEPSS 0.2%CVE-2025-0358HIGHDuring an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration fraEPSS 0.2%