CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- esengine deepseek-reasonix ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission 5.3 Medium
- openbmb internet of agents OpenBMB Internet of Agents Message app.py fetch_chat_record access control 6.9 Medium
- 201206030 novel xxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorization 6.9 Medium
- No product listed kubescape Output printresults.go GetWriter permission 2.4 Low
- nasa-gcn gcn.nasa.gov nasa-gcn gcn.nasa.gov Email Notification email improper authorization 5.3 Medium
- cyberlord92 oauth single sign on – sso (oauth client) WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability 9.8 Critical
- red hat build of keycloak Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Medium
- apache software foundation ofbiz Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders No score
- invoiceshelf InvoiceShelf MemberService.php create access control 5.1 Medium
- ntt data intellilink corporation hinemos Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an... 7.1 High
- shenzhen shine industrial co., ltd. vitafit VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access 6.3 Medium
- yangzongzhuan ruoyi-vue yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management 5.3 Medium
- uncanny owl toolkit for learndash WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability 9.8 Critical
- crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability 9.8 Critical
- miroslavpejic85 mirotalk p2p miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control 5.3 Medium
- easysoft zentao pms EasySoft ZenTao PMS User model.php checkGroupChange privileges management 5.3 Medium
- amazon aurora postgresql with babelfish, aws babelfish-for-postgresql +1 more Babelfish for PostgreSQL Privilege Escalation 8.7 High
- oray pugongying x5 pro Oray Pugongying X5 Pro API Authorization run_async_task improper authorization 9.4 Critical
- ken678 yzncms ken678 YznCMS Auth Group Group.php Backend privileges management 5.1 Medium
- hakan ozevin wp base booking WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability 8.8 High
- cozy vision sms alert order notifications WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability 9.8 Critical
- cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability 6.3 Medium
- looplj axonhub AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes 5.3 Medium
- boss media buddyboss platform, buddyboss platform +1 more WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability 8.8 High
- n8n-io n8n n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance 5.1 Medium
- bkwld decoy BKWLD Decoy Authorization Policy Policy.php privileges management 5.3 Medium
- bdtask garage 24 garage management software Bdtask Garage 24 Garage Management Software Backend improper authorization 5.3 Medium
- deepseek harness DeepSeek Harness Browser Auth browser-auth.ts improper authorization 6.9 Medium
- boneio black debian images Improper Privilege Assignment in boneIO 9.3 Critical
- No product listed JIZHICMS Front-end Order OrderController.php pay improper authorization 5.3 Medium
- icret easyimage icret EasyImage del.php privileges management 6.9 Medium
- openbq-org openbb openbq-org OpenBB Local API Server api_settings.py access control 5.3 Medium
- No product listed HeyCyan App FileProvider access control 6.9 Medium
- hewlett packard enterprise (hpe) arubaos (aos) Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10 4.9 Medium
- cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability 8.8 High
- No product listed HarnessRouter Identity Mode app.py improper authorization 6.3 Medium
- dhikshitha29 insurance-management-system dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization 6.9 Medium
- dhikshitha29 insurance-management-system dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization 6.9 Medium
- aws cicd-toolchain-for-serverless-applications Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications 8.7 High
- No product listed aaPanel common.py GetClientIp access control 6.9 Medium
- apple macos This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden... 5.5 Medium
- wpdeveloper essential addons for elementor WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability 6.4 Medium
- donetick donetick History Deletion model.go CanDeleteHistory improper authorization 5.3 Medium
- light0011 cms light0011 cms Captcha Validation UserController.class.php access control 6.9 Medium
- hamid alinia login with phone number WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability 8.1 High
- brainstorm force ottokit WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability 9.8 Critical
- getarcaneapp arcane Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) 8.8 High
- shabti frontend admin by dynamiapps WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability 9.8 Critical
- wp email newsletter team - fluentcrm fluent crm WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability 8.8 High
- wp email newsletter team - fluentcrm fluent crm WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability 9.8 Critical
- Show olderLoading…