CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- qianfox foxcmsFoxCMS improper authorization5.3 Medium
- jizhicmsJIZHICMS Article release.html improper authorization5.3 Medium
- jizhicmsJIZHICMS Article release.html improper authorization5.3 Medium
- jizhicmsJIZHICMS Account Profile Page userinfo.html improper authorization5.3 Medium
- code-projects human resource management system, human resource management +1 morecode-projects Human Resource Management System Account.go Index improper authorization5.1 Medium
- audi utr dashcamAudi UTR Dashcam Command API access control5.1 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L formVirtualServ access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L formTcpipSetup access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L formSetPortTr access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L DDNS Service formSetDDNS access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L formSetPassword access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L formSetDomainFilter access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L formAdvNetwork access control5.3 Medium
- d-link dir-605l, dir-618, dlink dir-605l firmware +1 more +3 moreD-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access control5.3 Medium
- berriai berriai/litellmImproper Authorization in BerriAI/litellm8.1 High
- china mobile gt3200-4g4p, gt3200-8g8p, p22g-ciac +2 more +4 moreChina Mobile P22g-CIac Telnet Service improper authorization4.8 Medium
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an...7.8 High
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G UPnP Service HNAP1 SetUpnpSettings improper authorization6.9 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorization6.9 Medium
- iroad dash cam x5, dash cam x6 +1 moreIROAD Dash Cam X5/Dash Cam X6 improper authorization9.3 Critical
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt Chat History chat deleteChat access control5.3 Medium
- stylemix directory listings wordpress plugin – ulisting, stylemixthemes ulisting +1 moreDirectory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- 274056675 springboot-openai-chatgpt274056675 springboot-openai-chatgpt User submit improper authorization6.9 Medium
- lovecards, lovecards lovecardsv2 +1 moreLoveCards LoveCardsV2 Setting other access control6.9 Medium
- thinkware car dashcam f800 pro, f800 pro firmware +1 moreThinkware Car Dashcam F800 Pro File Storage access control5.3 Medium
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System Reset Password Interface OperatorStop.asp improper authorization6.3 Medium
- phpgurukul pre-school enrollment systemPHPGurukul Pre-School Enrollment System Sub Admin add-subadmin.php access control5.1 Medium
- starsea99 starsea-mallStarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control5.3 Medium
- gmod apolloGMOD Apollo Incorrect Privilege Assignment7.1 High
- i-drive i11, i12, i11 firmware +1 more +3 morei-Drive i11/i12 Video Footage/Live Video Stream access control5.3 Medium
- zframeworks zzzj1983 zz improper authorization5.3 Medium
- No product listed/api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018...5.4 Medium
- frappe hrmspbrong hrms resource.go HrmsDB improper authorization6.9 Medium
- eastnets paymentsafeEastnets PaymentSafe URL Default.aspx improper authorization5.3 Medium
- blackmagic design inc davinci resolveDylib Hijacking in DaVinci Resolve8.4 High
- sitesao dhvc formDHVC Form <= 2.4.7 - Unauthenticated Privilege Escalation9.8 Critical
- mrcmsA vertical privilege escalation vulnerability in the component /controller/UserController.java of...4.8 Medium
- seventhqueen k elementsWordPress K Elements plugin < 5.4.0 - Unauthenticated Account Takeover vulnerability9.8 Critical
- rupeeseed technology ventures rupeewebInsufficient Authorization Vulnerability in RupeeWeb trading platform7.4 High
- r1bbit yimioaywoa setup.jsp improper authorization6.9 Medium
- http://apusthemes.com/ wp job board pro, apusthemes superio +1 moreWP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register9.8 Critical
- contempoinc real estate 7 wordpress, contempothemes real estate 7 +1 moreReal Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- fortinet fortiosAn incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4...8.0 High
- apphousekitchen aldente charge limiterAppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorization4.8 Medium
- ibm cloud pak for business automationIBM Cloud Pak for Business Automation incorrect privilege assignment4.3 Medium
- bowo admin and site enhancements (ase)WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2.1 - Privilege Escalation vulnerability7.5 High
- notfound admin and site enhancements (ase) proWordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.2.1 - Privilege Escalation vulnerability7.5 High
- cyberark privileged access managerPVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4...4.2 Medium
- imagination technologies graphics ddkGPU DDK - Arbitrary write of read-only dmabuf7.8 High
- campcodes school management softwareCampCodes School Management Software Staff edit-staff improper authorization5.3 Medium
- Show moreLoading…