Falhas do tipo CWE-269

2.507 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2024-46549HIGHAn issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonatingEPSS 0.4%CVE-2026-75481HIGHSkyPilot Authentication Bypass via Service Account Role EscalationEPSS 0.4%CVE-2022-29179HIGHImproper Privilege Management in CiliumEPSS 0.4%CVE-2026-41163HIGHbubblewrap vulnerable to privilege escalation in setuid mode via ptraceEPSS 0.4%CVE-2018-14791—Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on EPSS 0.4%CVE-2025-59514HIGHMicrosoft Streaming Service Proxy Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2022-32819HIGHA logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8EPSS 0.4%CVE-2024-3137HIGHImproper Privilege Management in uvdesk/community-skeletonEPSS 0.4%CVE-2025-9966HIGHExecution with Unnecessary PrivilegesEPSS 0.4%CVE-2023-38292HIGHCertain software builds for the TCL 20XE Android device contain a vulnerable, pre-installed app with a package name of com.tct.gcs.hiddenmenEPSS 0.4%CVE-2026-19222MEDIUMForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassEPSS 0.4%CVE-2026-57599MEDIUMThere is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attacEPSS 0.4%CVE-2018-8841—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 0.4%CVE-2026-83483HIGHVulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self-serv What-if Analysis). Supported versionEPSS 0.4%CVE-2026-83450HIGHVulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are EPSS 0.4%CVE-2026-87068MEDIUMForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form ImportEPSS 0.4%CVE-2026-87245HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.4%CVE-2024-13376HIGHIndustrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.4%CVE-2026-28976HIGHAn information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root prEPSS 0.4%CVE-2024-5525HIGHImproper privilege management vulnerability in AstrotalksEPSS 0.4%