Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2025-57443MEDIUMFrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that alEPSS 0.1%CVE-2026-86893LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 2EPSS 0.1%CVE-2025-43722MEDIUMDell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability. A high privileged attacker with EPSS 0.1%CVE-2025-69257MEDIUMtheshit vulnerable to unsafe loading of user-owned Python rules when running as root.EPSS 0.1%CVE-2025-6723MEDIUMUntrusted user data can lead to privilege escalationEPSS 0.1%CVE-2026-29123HIGHMultiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege EscalationEPSS 0.1%CVE-2025-27811HIGHA local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escaEPSS 0.1%CVE-2025-22165MEDIUMThis Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (ArbitrarEPSS 0.1%CVE-2026-31369LOWPrivilege Bypass in PcManagerEPSS 0.1%CVE-2026-60938MEDIUMVulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions thatEPSS 0.1%CVE-2026-17863HIGHInappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escEPSS 0.1%CVE-2026-89001MEDIUMWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign SettingsEPSS 0.1%CVE-2026-0055MEDIUMIn createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid dirEPSS 0.1%CVE-2026-29124HIGHMultiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege EscalationEPSS 0.1%CVE-2023-22576HIGHDell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low prEPSS 0.1%CVE-2026-73729MEDIUMAuthenticated Sensitive Information Disclosure in HPE Networking Fabric ComposerEPSS 0.1%CVE-2025-4879HIGHCitrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegesEPSS 0.1%CVE-2026-61120HIGHVulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affeEPSS 0.1%CVE-2026-87240HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.1%CVE-2026-60833HIGHVulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. DifficEPSS 0.1%