Fallos del tipo CWE-269

2508 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2024-5566MEDIUMImproper Privilege Management allows for access to unauthorized repository content during migrationEPSS 0.5%CVE-2024-33550HIGHWordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2026-89426HIGHKnit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role FieldEPSS 0.5%CVE-2023-47868HIGHWordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-43245CRITICALWordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerabilityEPSS 0.5%CVE-2024-43311CRITICALWordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2023-41806HIGHMisassignment of privileges can cause DOS attackEPSS 0.5%CVE-2022-48284CRITICALA piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnEPSS 0.5%CVE-2026-84115MEDIUMCleo Harmony JWT Refresh Token connections privileges managementEPSS 0.5%CVE-2026-48010MEDIUMShopware: Privilege escalation: non-admin user with user:create ACL can create admin accountsEPSS 0.5%CVE-2023-47629HIGHPrivilege escalation through email sign-up in datahubEPSS 0.5%CVE-2022-48283CRITICALA piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnEPSS 0.5%CVE-2024-0003CRITICALA condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the arrayEPSS 0.5%CVE-2026-64637CRITICALImproper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessiEPSS 0.5%CVE-2025-66428HIGHAn issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.EPSS 0.5%CVE-2024-39206HIGHAn issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup dueEPSS 0.5%CVE-2022-42046HIGHwfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalationEPSS 0.5%CVE-2026-42185MEDIUMPeople: Privilege Escalation via Missing Role Ceiling in Mail Domain InvitationEPSS 0.5%CVE-2024-33223HIGHAn issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute EPSS 0.5%CVE-2026-72829HIGHGrav before 1.0.13 API Key Scope Bypass via UsersControllerEPSS 0.5%