Weaknesses of type CWE-269

2,518 results

Gestão inadequada de privilégios

A aplicação falha em atribuir, modificar, rastrear ou validar corretamente os privilégios de um usuário ou processo, permitindo que ele acesse ou execute operações além do que deveria. Isso acontece quando o controle de acesso é incompleto, inconsistente ou ausente em pontos críticos do código.

Example

Um usuário comum consegue editar perfis de administrador porque a aplicação verifica permissões apenas na interface web, mas não na API backend; ou um processo que perde privilégios elevados durante sua execução consegue executar ações sensíveis sem validação adicional.

How to mitigate

Implemente validação de privilégios em toda camada de negócio (não apenas UI), use modelos de controle de acesso consistentes (RBAC, ABAC), valide permissões antes de cada operação sensível e teste cenários de escalação de privilégio em testes de segurança.

CVE-2021-20334MEDIUMLocal privilege escalation in MongoDB Compass for WindowsEPSS 0.2%CVE-2026-33727MEDIUMPi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).EPSS 0.2%CVE-2018-9375HIGHIn multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confusEPSS 0.2%CVE-2022-20360MEDIUMIn setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege fEPSS 0.2%CVE-2022-44733HIGHLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (WindoEPSS 0.2%CVE-2025-24258HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS VenturEPSS 0.2%CVE-2023-28737HIGHImproper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escalEPSS 0.2%CVE-2025-62592MEDIUMVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.EPSS 0.2%CVE-2022-2249HIGHAvaya Aura Communication Manager Privilege Escalation VulnerabilitiesEPSS 0.2%CVE-2025-23007MEDIUMA vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentiaEPSS 0.2%CVE-2023-3027HIGHThe grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtaiEPSS 0.2%CVE-2026-40317CRITICALNovumOS has Privilege Escalation in the Syscall InterfaceEPSS 0.2%CVE-2021-31836MEDIUMImproper Privilege Management in MA for WindowsEPSS 0.2%CVE-2024-0819HIGHIncomplete protection of personal password settingsEPSS 0.2%CVE-2026-42289HIGHChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege EscalationEPSS 0.2%CVE-2023-37907HIGHCryptomator's MSI installer allows local privilege escalationEPSS 0.2%CVE-2026-30960CRITICALRSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI InterfaceEPSS 0.2%CVE-2024-2390HIGHLocal Privilege Escalation EPSS 0.2%CVE-2025-61786LOWDeno's --deny-read check does not prevent permission bypassEPSS 0.2%CVE-2021-27766MEDIUMHCL BigFix Platform Client is affected by a Privilege Escalation VulnerabilityEPSS 0.2%