Fallos del tipo CWE-269

2510 resultados

Gestão inadequada de privilégios

A aplicação não controla corretamente quais permissões um usuário ou processo possui, permitindo que ele acesse, modifique ou execute ações além do que deveria. Isso acontece quando a lógica de verificação de privilégios é fraca, ausente ou implementada de forma inconsistente, criando brechas onde um ator com poucos direitos consegue agir como se tivesse privilégios administrativos.

Ejemplo

Um sistema web onde o controle de acesso verifica se o usuário é admin apenas na tela inicial, mas não valida novamente ao processar requisições diretas de API. Um usuário comum consegue chamar endpoints administrativos diretamente, contornando a verificação.

Cómo mitigar

Implemente verificação de privilégios em **toda** operação sensível, não apenas na apresentação — valide no backend antes de executar qualquer ação. Use um modelo de controle de acesso consistente (RBAC ou ABAC), aplique o princípio do privilégio mínimo e revise regularmente quem tem acesso ao quê.

CVE-2024-45919MEDIUMA security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the RequeEPSS 0.3%CVE-2026-72631MEDIUMImproper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API KeysEPSS 0.3%CVE-2025-22220MEDIUMVMware Aria Operations for Logs broken access control vulnerability (CVE-2025-22220)EPSS 0.3%CVE-2025-63909HIGHIncorrect access control in the component /opt/SRLtzm/bin/TapeDumper of Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allowsEPSS 0.3%CVE-2024-30473MEDIUMDell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privileged attacker could pEPSS 0.3%CVE-2026-49176HIGHWindows WalletService Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-77203HIGHGroups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' ShortcodeEPSS 0.3%CVE-2026-69414HIGHMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2020-11846HIGHImproper handling of token allows access to restricted resource in Privileged Access ManagerEPSS 0.3%CVE-2025-11923HIGHLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege EscalationEPSS 0.3%CVE-2024-45297MEDIUMPrevent topic list filtering by hidden tags for unauthorized users in DiscourseEPSS 0.3%CVE-2026-79226HIGHImproper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social eEPSS 0.3%CVE-2026-46804HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that EPSS 0.3%CVE-2026-34496HIGHvictor Web - Priviledge EscalationEPSS 0.3%CVE-2026-18550CRITICALNokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' ParameterEPSS 0.3%CVE-2025-59705MEDIUMEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a PhysiEPSS 0.3%CVE-2023-32713HIGHLocal Privilege Escalation via the ‘streamfwd’ program in Splunk App for StreamEPSS 0.3%CVE-2026-65835MEDIUMCapsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)EPSS 0.3%CVE-2025-8107MEDIUMIn OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executiEPSS 0.3%CVE-2024-1575MEDIUMThe improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an autheEPSS 0.3%