Fallos del tipo CWE-269

2827 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2023-0524HIGHAs part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a maliciouEPSS 0.6%CVE-2023-46647HIGHImproper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation EPSS 0.6%CVE-2026-37107CRITICALAn issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php componentEPSS 0.6%CVE-2023-28339HIGHOpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTEEPSS 0.6%CVE-2023-32197HIGHRancher's External RoleTemplates can lead to privilege escalationEPSS 0.6%CVE-2026-15215HIGHSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationEPSS 0.6%CVE-2025-47713HIGHApache CloudStack: Domain Admin can reset Admin password in Root DomainEPSS 0.6%CVE-2025-47849HIGHApache CloudStack: Insecure access of user's API/Secret Keys in the same domainEPSS 0.6%CVE-2026-104018HIGHVxWorks 7 improper privilege managementEPSS 0.6%CVE-2023-47682HIGHWordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerabilityEPSS 0.6%CVE-2025-28399CRITICALAn issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address ControlEPSS 0.6%CVE-2025-12981CRITICALListee <= 1.1.6 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2026-73218HIGHCursor: Sandbox escape via launching privileged containersEPSS 0.6%CVE-2024-0751HIGHA malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, aEPSS 0.6%CVE-2023-37058CRITICALInsecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to escalate privileges vEPSS 0.6%CVE-2022-34703HIGHWindows Partition Management Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2022-32840HIGHThis issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app mayEPSS 0.6%CVE-2020-36603MEDIUMThe HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calEPSS 0.6%CVE-2023-7080HIGHArbitrary remote code execution within wrangler dev Workers sandboxEPSS 0.6%CVE-2023-5978—Incorrect libcap_net limitation list manipulationEPSS 0.6%