Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2026-73713HIGHLocal Privilege Escalation Vulnerabilities in HPE Networking Fabric ComposerEPSS 0.1%CVE-2023-26236—An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, EPSS 0.1%CVE-2025-67826HIGHAn issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antiEPSS 0.1%CVE-2023-2847HIGHLocal privilege escalation in ESET products for Linux and MacOSEPSS 0.1%CVE-2024-0622HIGHLocal privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms. EPSS 0.1%CVE-2023-41099HIGHIn the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).EPSS 0.1%CVE-2026-84587MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS TahoeEPSS 0.1%CVE-2026-60886HIGHVulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that arEPSS 0.1%CVE-2024-0172HIGHDell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated EPSS 0.1%CVE-2026-84603MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An appEPSS 0.1%CVE-2026-38764HIGHAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sysEPSS 0.1%CVE-2026-16607HIGHAuthenticated local root privilege escalation vulnerability in openFT for Linux and Oracle SolarisEPSS 0.1%CVE-2026-29127CRITICALIncorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100EPSS 0.1%CVE-2023-1548MEDIUM A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the consEPSS 0.1%CVE-2026-15379MEDIUMArbitrary File Read as SYSTEM in Symantec ITMSEPSS 0.1%CVE-2026-46873HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affecEPSS 0.1%CVE-2026-9789HIGHNitroSense V3: Security Vulnerability InformationEPSS 0.1%CVE-2024-5760HIGHThe Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shellEPSS 0.1%CVE-2026-40002MEDIUMZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.EPSS 0.1%CVE-2024-20262MEDIUMA vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to EPSS 0.1%