Falhas do tipo CWE-269

2.803 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2023-33966HIGHDeno missing "--allow-net" permission check for built-in Node modulesEPSS 0.6%CVE-2022-38065HIGHA privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissivEPSS 0.6%CVE-2026-76678HIGHAuthenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN GatewaysEPSS 0.6%CVE-2026-38529HIGHA Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attEPSS 0.6%CVE-2024-22752HIGHInsecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executableEPSS 0.6%CVE-2023-28261MEDIUMMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2020-26063MEDIUMCisco Integrated Management Controller Software Authorization Bypass VulnerabilityEPSS 0.6%CVE-2021-4200MEDIUMWrite access to the Catalog for any user when restricted-admin role is enabledEPSS 0.6%CVE-2022-41604HIGHCheck Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissiEPSS 0.6%CVE-2022-0222HIGHA CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the contEPSS 0.6%CVE-2024-9265CRITICALEcho RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2025-11533CRITICALWP Freeio <= 1.2.21 - Unauthenticated Privilege EscalationEPSS 0.6%CVE-2022-41268HIGHIn some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200EPSS 0.6%CVE-2022-32829HIGHThis issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to eEPSS 0.6%CVE-2026-26369HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroupEPSS 0.6%CVE-2023-28855MEDIUMFields GLPI plugin vulnerable to unauthorized write access to additional fieldsEPSS 0.6%CVE-2026-50770CRITICALAn issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.EPSS 0.6%CVE-2026-50774CRITICALAn issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role.EPSS 0.6%CVE-2025-40538CRITICALSolarWinds Serv-U Broken Access Control Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-29166—A logic issue was addressed with improved state management. This issue is fixed in Pro Video Formats 2.2.5. A user may be able to elevate prEPSS 0.6%