Falhas do tipo CWE-269

2.508 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2023-4936MEDIUMSynaptics-DisplayLink-privilege escalation vulnerability via a dynamic library sideloadingEPSS 0.2%CVE-2025-31243HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VenturEPSS 0.2%CVE-2022-38060HIGHA privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sEPSS 0.2%CVE-2022-2975HIGHAvaya Aura Application Enablement Services weak permissions in web applicationEPSS 0.2%CVE-2023-43506HIGHLocal Privilege Escalation in ClearPass OnGuard Linux AgentEPSS 0.2%CVE-2026-20287MEDIUMCisco Identity Services Engine Hardening Release - Improper Privlege Management VulnerabilitiesEPSS 0.2%CVE-2024-42440MEDIUMZoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS - Improper Privilege ManagementEPSS 0.2%CVE-2025-43256HIGHThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be abEPSS 0.2%CVE-2023-5797MEDIUMAn improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEEPSS 0.2%CVE-2025-66173MEDIUMThere is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the sEPSS 0.2%CVE-2024-4395HIGHLack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege EscalationEPSS 0.2%CVE-2024-40861HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to gain root privileges.EPSS 0.2%CVE-2022-26057MEDIUMMint WorkBench Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-61413MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A lEPSS 0.2%CVE-2025-55076MEDIUMA local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.EPSS 0.2%CVE-2023-27795—An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key.EPSS 0.2%CVE-2026-7971MEDIUMInappropriate implementation in ORB in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass site isolation via a craftedEPSS 0.2%CVE-2022-24408—A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binaryEPSS 0.2%CVE-2023-27793—An issue discovered in IXP Data Easy Install v.6.6.14884.0 allows local attackers to gain escalated privileges via weak encoding of sensitivEPSS 0.2%CVE-2025-40594MEDIUMA vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS EPSS 0.2%