Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2025-7779HIGHLocal privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) beforeEPSS 0.1%CVE-2025-10650LOWImproper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative UsersEPSS 0.1%CVE-2023-21114HIGHIn multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege withEPSS 0.1%CVE-2026-9490MEDIUMAcer Care Center creates a Named Pipe with a weak Security DescriptorEPSS 0.1%CVE-2025-9059HIGHElevation of Privileges Vulnerability in IT Management SuiteEPSS 0.1%CVE-2024-0046HIGHIn installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the codEPSS 0.1%CVE-2024-13975HIGHCommvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent AbuseEPSS 0.1%CVE-2022-24931HIGHImproper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to exeEPSS 0.1%CVE-2026-23772HIGHDell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management vulnerability. A loEPSS 0.1%CVE-2026-2640MEDIUMDuring an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticatedEPSS 0.1%CVE-2026-17438MEDIUMIBM i is Affected By An Improper Privilege Management Vulnerability in LDAP []EPSS 0.1%CVE-2026-45256MEDIUMMissing permission check in thr_kill2(2)EPSS 0.1%CVE-2026-32802MEDIUMDell PowerPath, version 7.2 through to 8.0 SP1, contains an Improper Privilege Management vulnerability. A low privileged attacker with locaEPSS 0.1%CVE-2026-32323HIGHMullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installerEPSS 0.1%CVE-2024-24970MEDIUMPotential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software DrivEPSS 0.1%CVE-2026-0046MEDIUMIn InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attacEPSS 0.1%CVE-2026-73725HIGHLocal Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric ComposerEPSS 0.1%CVE-2026-20890HIGHImproper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an escEPSS 0.1%CVE-2026-60957MEDIUMVulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versionEPSS 0.1%CVE-2023-52543MEDIUMPermission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%