Falhas do tipo CWE-269

2.509 resultados

Controle de privilégios inadequado ou ausente

A aplicação falha em validar, atribuir ou manter corretamente os privilégios de um usuário ou processo, permitindo que ele acesse recursos ou execute ações além do que deveria. Isso ocorre quando o controle de acesso é ausente, inconsistente ou não é verificado em todos os pontos críticos do código.

Exemplo

Um usuário comum consegue acessar um endpoint de administração porque a aplicação não valida se ele tem permissão, ou um processo web consegue ler arquivos do sistema que deveriam estar restritos apenas ao root — em ambos os casos, o código simplesmente não conferiu os privilégios antes de executar a operação.

Como mitigar

Implemente verificações de autorização em cada operação sensível (acesso a dados, mudança de configurações, etc.), use um modelo de privilégios bem definido (RBAC, ABAC), e verifique permissões de forma centralizada — nunca confie apenas em frontend ou em ausência de validação. Mantenha auditoria de quem fez o quê e quando.

CVE-2022-4294HIGHNorton, Avira, Avast and AVG Antivirus for Windows Privilege EscalationEPSS 0.2%CVE-2022-46358HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2026-41489HIGHPi-hole: Local privilege escalation via config-controlled path in root-executed service hooksEPSS 0.2%CVE-2022-46356HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2022-46357HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2025-4681HIGHImproper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affectEPSS 0.2%CVE-2022-46359HIGHPotential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andEPSS 0.2%CVE-2025-43320HIGHThe issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypasEPSS 0.2%CVE-2024-8424HIGHWatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEMEPSS 0.2%CVE-2025-50674HIGHAn issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowingEPSS 0.2%CVE-2023-27316HIGHPrivilege Escalation Vulnerability in SnapCenterEPSS 0.2%CVE-2026-35272HIGHVulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions EPSS 0.2%CVE-2026-60248CRITICALVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.EPSS 0.2%CVE-2024-0219HIGHPrivilege Elevation via Telerik JustDecompile InstallerEPSS 0.2%CVE-2023-51776HIGHImproper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code.EPSS 0.2%CVE-2024-11467HIGHOmnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of tEPSS 0.2%CVE-2024-21118MEDIUMVulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions thatEPSS 0.2%CVE-2026-20607MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS TahoEPSS 0.2%CVE-2024-21813HIGHExposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalatiEPSS 0.2%CVE-2026-7977MEDIUMInappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same origin policy via a EPSS 0.2%