Fallos del tipo CWE-269

2495 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2024-41666MEDIUMThe Argo CD web terminal session does not handle the revocation of user permissions properly.EPSS 0.7%CVE-2026-26725CRITICALAn issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AEPSS 0.7%CVE-2026-59260HIGHOpenWrt luci-app-samba4 read ACL remote code execution via smbdEPSS 0.7%CVE-2025-34204HIGHVasion Print (formerly PrinterLogic) Processes Running as Root Inside Docker InstancesEPSS 0.7%CVE-2024-24778MEDIUMApache StreamPipes: Resources Permission EscalationEPSS 0.7%CVE-2022-43759HIGHRancher: Privilege escalation via promoted rolesEPSS 0.7%CVE-2024-43401CRITICALIn XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themEPSS 0.7%CVE-2023-28632HIGHGLPI vulnerable to account takeover by authenticated userEPSS 0.7%CVE-2023-36100—An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameterEPSS 0.7%CVE-2025-7851HIGHUnauthorized root access via debug functionalityEPSS 0.7%CVE-2026-7284CRITICALEasy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_registerEPSS 0.7%CVE-2023-37389HIGHWordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.7%CVE-2022-45963CRITICALh3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.EPSS 0.7%CVE-2024-32003HIGHDusk plugin may allow unfettered user authentication in misconfigured installsEPSS 0.7%CVE-2021-45729MEDIUMWordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerabilityEPSS 0.7%CVE-2023-5402CRITICAL A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used EPSS 0.7%CVE-2023-21987HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PrioEPSS 0.7%CVE-2022-39007CRITICALThe location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privileEPSS 0.7%CVE-2026-34528HIGHFile Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionEPSS 0.7%CVE-2026-45395HIGHOpen WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code ExecutionEPSS 0.7%