Weaknesses of type CWE-269

2,793 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2023-48902CRITICALAn issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car dEPSS 1.3%CVE-2017-0935—Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection EPSS 1.3%CVE-2023-4822MEDIUMGrafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations,EPSS 1.3%CVE-2026-84830HIGHOS command injection in privileged configuration handlingEPSS 1.2%CVE-2021-27657HIGHMetasys Improper Privilege ManagementEPSS 1.2%CVE-2021-28814HIGHImproper Access Control Vulnerability in HelpdeskEPSS 1.2%CVE-2017-0932—Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation EPSS 1.2%CVE-2022-20361MEDIUMIn btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth StaEPSS 1.2%CVE-2024-13997CRITICALNagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on HostEPSS 1.2%CVE-2024-14009CRITICALNagios XI < 2024R1.0.1 Privilege Escalation via System ProfileEPSS 1.2%CVE-2022-39395CRITICALVela Insecure DefaultsEPSS 1.2%CVE-2021-31204HIGH.NET and Visual Studio Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2025-7341CRITICALHT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File DeletionEPSS 1.2%CVE-2020-7509—A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow aEPSS 1.2%CVE-2022-42735HIGHApache ShenYu Admin ultra viresEPSS 1.2%CVE-2022-2273—Simple Membership < 4.1.3 - Membership Privilege EscalationEPSS 1.2%CVE-2018-19635—CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.EPSS 1.2%CVE-2026-7465HIGHSpectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block AttributesEPSS 1.2%CVE-2023-42468—The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consentEPSS 1.2%CVE-2021-43835HIGHPrivilege escalation in the Sulu Admin panelEPSS 1.2%