CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- microfocus netiq access manager, netiq access manager +1 moreUser impersonation with MFA when configure in specific way7.7 High
- mage mage-aiMage AI allows deleted users to use the terminal server with admin access, leading to remote code execution7.1 High
- dell power manager (dpm), power manager +1 moreDell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment...8.8 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Sensitive Information Disclosure Vulnerability6.5 Medium
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- grafana, grafana enterprise +1 moreGrafana plugin data sources vulnerable to access control bypass4.4 Medium
- elabftwIn eLabFTW, if administrators can create users, users can too5.4 Medium
- zoom rooms, workplace desktop, zoom communications inc. workplace desktop app for macos, zoom meeting sdk for macos, zoom rooms client for macos +2 more +4 moreZoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS - Incorrect Privilege Assignment6.2 Medium
- wofficeio wofficeWordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- sprecher automation sprecon-e, sprecher-automation sprecon-e-c firmware, sprecon-e-p dd6-2 firmware +10 more +12 moreImproper Privilege Management vulnerability in Sprecher Automation SPRECON-E6.5 Medium
- avaya aura system managerImproper access control in Avaya Aura System Manager4.2 Medium
- google androidIn multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to...7.8 High
- sky co.,ltd. skysea client viewIncorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19...7.8 High
- tencent wechatInsecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate...8.8 High
- hwameistorInsecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate...8.4 High
- otrsAgents are able to lock the ticket without the "Owner" permission5.2 Medium
- nootheme jobmonsterWordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- iqbalrony wp user switchWordPress WP User Switch plugin <= 1.1.0 - Privilege Escalation vulnerability8.0 High
- siemens ruggedcom rmc8388 v5.x, ruggedcom rmc8388nc v5.x, ruggedcom rs416ncv2 v5.x +63 more +65 moreA vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM...7.5 High
- dell powerscale onefsDell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management...6.7 Medium
- dell powerscale onefsDell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment...6.7 Medium
- ibm mqIBM MQ privilege escalation7.5 High
- microsoft office, softmaker software gmbh freeoffice +1 moreLocal Privilege Escalation via MSI installer5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreDisabling a user account changes its author, allowing RCE from user account in XWiki9.1 Critical
- ibm iIBM i privilege escalation7.4 High
- nvidia cloud gaming, cloud gaming virtual gpu, vgpu software and cloud gaming +1 more +3 moreCVE6.3 Medium
- dnscrypt dnscrypt-proxyInsecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to...7.8 High
- amazon aws deployment framework, awslabs aws-deployment-framework +1 moreaws-deployment-framework's potential risk can lead to privilege escalation7.6 High
- deluxethemes userproWordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability9.8 Critical
- pokornydavid frontend registration – contact form 7Frontend Registration – Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation7.2 High
- google androidIn multiple functions of ManagedServices.java, there is a possible way to hide an app with...7.8 High
- linux, linux kernel +1 moreethtool: strset: fix message length calculation7.5 High
- sirvWordPress Sirv plugin <= 7.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability8.8 High
- hamid alinia login with phone numberWordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability8.8 High
- masteriyo, masteriyo - lms +1 moreWordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability9.8 Critical
- instawp connectWordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability8.8 High
- cisco confd, network services orchestrator, crosswork network services orchestrator +1 more +3 moreA vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could...7.8 High
- totalavInsecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate...7.8 High
- hp inc. plantronics hub, hp poly plantronics hub +1 moreA privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.6.7 Medium
- ibm aix, vios +1 moreIBM AIX privilege escalation8.1 High
- extremenetworks extremexosIn Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted...8.6 High
- wp-buy login as user or customer (user switching), login as user or customer \(user switching\) +1 moreWordPress Login as User or Customer plugin <= 3.8 - Unauthenticated Account Takeover vulnerability9.8 Critical
- tcl 30z firmwareVarious software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI...8.8 High
- tcl 30z firmwareVarious software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system...8.0 High
- sanluan flipped aurora gin vueAn issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges...4.7 Medium
- stylemixthemes masterstudy lms, stylemix masterstudy lms wordpress plugin – for online courses and education +1 moreMasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action9.8 Critical
- teledyne flir ax8, flir ax8 firmware +1 moreTeledyne FLIR AX8 User Registration test_login.php improper authorization5.3 Medium
- cisco ios xr software, ios xr +1 moreA vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers...7.8 High
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17.4, iOS...7.8 High
- drupal registration role, registration role project role +1 moreRegistration role - Critical - Access bypass - SA-CONTRIB-2024-0158.8 High
- Show moreLoading…