Fallos del tipo CWE-269

2510 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2026-49501MEDIUMDell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vuEPSS 0.2%CVE-2023-51429MEDIUM Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2025-54821LOWAn Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11EPSS 0.2%CVE-2026-26946MEDIUMDell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper privilege management vulnerabEPSS 0.2%CVE-2026-26947MEDIUMDell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulneraEPSS 0.2%CVE-2026-12502HIGHLoytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudoEPSS 0.2%CVE-2025-6943LOWSecret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to rEPSS 0.2%CVE-2023-40375HIGHIBM i privilege escalationEPSS 0.2%CVE-2026-84083HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.2%CVE-2025-49156HIGHA link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected insEPSS 0.2%CVE-2026-29121HIGH`/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEEPSS 0.1%CVE-2023-40685HIGHIBM i privilege escalationEPSS 0.1%CVE-2026-75777HIGHMultiple vulnerabilities in IBM Aspera Enterprise WebappsEPSS 0.1%CVE-2021-23893HIGHPrivilege Escalation vulnerability in McAfee Drive Encryption (MDE)EPSS 0.1%CVE-2026-28889MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary fileEPSS 0.1%CVE-2026-23599HIGHLocal Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for LinuxEPSS 0.1%CVE-2026-30769HIGHAn issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sEPSS 0.1%CVE-2022-37929MEDIUMImproper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary FlEPSS 0.1%CVE-2026-19220LOWForminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege EscalationEPSS 0.1%CVE-2026-6389HIGHIBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerabilityEPSS 0.1%