Falhas do tipo CWE-269

2.510 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2023-52543MEDIUMPermission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-63701MEDIUMDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low priEPSS 0.1%CVE-2026-27456MEDIUMutil-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device SetupEPSS 0.1%CVE-2026-0048MEDIUMIn hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This cEPSS 0.1%CVE-2026-83249HIGHVulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). TheEPSS 0.1%CVE-2026-83239HIGHVulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca ApplicEPSS 0.1%CVE-2026-83316HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The suppoEPSS 0.1%CVE-2026-63700HIGHDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attackEPSS 0.1%CVE-2026-44218LOWciguard: Container image runs as root (no USER directive)EPSS 0.1%CVE-2025-10578MEDIUMHP Support Assistant - Potential Escalation of PrivilegeEPSS 0.1%CVE-2022-20356MEDIUMIn shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due EPSS 0.1%CVE-2025-31272HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protEPSS 0.1%CVE-2025-66265MEDIUMInsecure permissions in configuration directory (C:\\usr)EPSS 0.1%CVE-2025-24006HIGHPrivilege Escalation via Insecure SSH PermissionsEPSS 0.1%CVE-2026-83323HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The suppoEPSS 0.1%CVE-2026-58846HIGHIn kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation ofEPSS 0.1%CVE-2020-9222HIGHThere is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need EPSS 0.1%CVE-2026-18107HIGHCriu: criu: container escape via rseq critical section hijack during checkpoint/restoreEPSS 0.1%CVE-2025-15547HIGHJail escape by a privileged user via nullfsEPSS 0.1%CVE-2025-43019MEDIUMHP Support Assistant – Potential Escalation of PrivilegeEPSS 0.1%