Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2026-83598HIGHNetdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI RepairEPSS 0.2%CVE-2026-0063CRITICALIn setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the codEPSS 0.2%CVE-2026-75857HIGHCodeWhale before 0.8.64 Privilege Escalation via exec_shell_interactEPSS 0.2%CVE-2025-25230HIGHOmnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is inEPSS 0.2%CVE-2024-44250HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbEPSS 0.2%CVE-2025-24183MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local EPSS 0.2%CVE-2026-60847LOWVulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are afEPSS 0.2%CVE-2026-28840HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS TahoEPSS 0.2%CVE-2023-21458MEDIUMImproper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn offEPSS 0.2%CVE-2026-34218MEDIUMClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modificationEPSS 0.2%CVE-2024-34741HIGHIn setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaEPSS 0.2%CVE-2025-0893HIGHSymantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability.EPSS 0.2%CVE-2024-2431MEDIUMGlobalProtect App: Local User Can Disable GlobalProtectEPSS 0.2%CVE-2022-41835HIGHF5OS vulnerability CVE-2022-41835EPSS 0.2%CVE-2026-31368HIGHPrivilege Bypass in AiAssistantEPSS 0.2%CVE-2025-22231HIGHVMware Aria Operations updates address a local privilege escalation vulnerability (CVE-2025-22231)EPSS 0.2%CVE-2026-15430MEDIUMCVE-2026-15430EPSS 0.2%CVE-2026-34397MEDIUMhimmelblau: NSS fake-primary group lookup reintroduces name collision riskEPSS 0.2%CVE-2023-28758HIGHAn issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NeEPSS 0.2%CVE-2026-28995HIGHA logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOSEPSS 0.2%