Fallos del tipo CWE-269

2509 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2024-3137HIGHImproper Privilege Management in uvdesk/community-skeletonEPSS 0.4%CVE-2022-32819HIGHA logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8EPSS 0.4%CVE-2025-59514HIGHMicrosoft Streaming Service Proxy Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-9966HIGHExecution with Unnecessary PrivilegesEPSS 0.4%CVE-2026-87068MEDIUMForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form ImportEPSS 0.4%CVE-2026-83450HIGHVulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are EPSS 0.4%CVE-2026-57599MEDIUMThere is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attacEPSS 0.4%CVE-2026-83483HIGHVulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self-serv What-if Analysis). Supported versionEPSS 0.4%CVE-2018-8841—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 0.4%CVE-2026-19222MEDIUMForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassEPSS 0.4%CVE-2023-38292HIGHCertain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenEPSS 0.4%CVE-2026-87245HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.4%CVE-2024-13376HIGHIndustrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.4%CVE-2026-28976HIGHAn information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root prEPSS 0.4%CVE-2026-40009MEDIUMApache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditorEPSS 0.4%CVE-2025-32974CRITICALorg.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typeEPSS 0.4%CVE-2024-5525HIGHImproper privilege management vulnerability in AstrotalksEPSS 0.4%CVE-2026-26010HIGHLeaky JWTs in OpenMetadata exposing highly-privileged bot usersEPSS 0.4%CVE-2026-23990MEDIUMFlux Operator Web UI Impersonation Bypass via Empty OIDC ClaimsEPSS 0.4%CVE-2024-46999HIGHUser Grant Deactivation not Working in ZitadelEPSS 0.4%