CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setUrlFilterRules access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setScheduleCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setUPnPCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setDdnsCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setSmartQosCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg access control6.9 Medium
- totolink a3700r, a3700r firmware +1 moreTOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control6.9 Medium
- code-projects studentmanagerZeroWdd/code-projects studentmanager getTeacherList improper authorization5.3 Medium
- code-projects db-hospital-drugJamesZBL/code-projects db-hospital-drug ShiroConfig.java improper authorization5.3 Medium
- veal98 小牛肉 echo 开源社区系统veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorization5.3 Medium
- code-projects studentmanagerhuanfenz/code-projects StudentManager Teacher String improper authorization5.3 Medium
- wowjoy 浙江湖州华卓信息科技有限公司 internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization5.3 Medium
- code-projects employee management systemTutorials-Website Employee Management System update-user.php improper authorization6.9 Medium
- code-projects employee management systemTutorials-Website Employee Management System delete-user.php improper authorization6.9 Medium
- rankology seo – on-site seoWordPress Rankology SEO – On-site SEO plugin <= 2.2.4 - Privilege Escalation Vulnerability9.8 Critical
- john james jacoby wp user profilesWordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability8.8 High
- mestres do wp checkout mestres wpWordPress Checkout Mestres WP plugin <= 8.7.5 - Privilege Escalation Vulnerability9.8 Critical
- ibm security guardiumIBM Security Guardium information disclosure4.9 Medium
- inaba denki sangyo co., ltd. ac-wps-11ac, ac-pd-wps-11ac, ac-pd-wps-11ac-p +3 more +5 moreIncorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP...4.3 Medium
- lenve vbloglenve VBlog WebSecurityConfig.java configure access control5.3 Medium
- iteaj iboot, iboot 物联网网关 +1 moreiteaj iboot 物联网网关 Admin Password pwd access control5.3 Medium
- 1902756969 ikun library1902756969/code-projects IKUN_Library Borrow MvcConfig.java addInterceptors access control5.3 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop Registration Master.php access control5.3 Medium
- xujiangfei admintwoxujiangfei admintwo updateSet access control5.3 Medium
- xujiangfei admintwoxujiangfei admintwo home access control5.3 Medium
- favethemes homeyWordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability9.8 Critical
- tomdever wpforo forumWordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability7.6 High
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 wrlwpsset access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface VirSerDMZ access control6.9 Medium
- ageerle ruoyi-aiageerle ruoyi-ai SysNoticeController.java improper authorization6.9 Medium
- ageerle ruoyi-ai, pandarobot ruoyi ai +1 moreageerle ruoyi-ai API Interface SysModelController.java improper authorization6.9 Medium
- dimitri grassi salon booking systemWordPress Salon booking system plugin < 10.15 - Privilege Escalation vulnerability7.2 High
- suse rancherRancher: Restricted Administrator can change Administrator's passwords9.1 Critical
- No product listedAn issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the...5.9 Medium
- fit2cloud jumpserverJumpServer has a Kubernetes Token Leak Vulnerability4.3 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface SysToolDDNS access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface SysToolChangePwd access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface qossetting access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 default.cfg access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface AdvSetWrlsafeset access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface AdvSetWrlmacfilter access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface AdvSetWrlGstset access control6.9 Medium
- tenda fh1202, fh1202 firmware +1 moreTenda FH1202 Web Management Interface AdvSetWrl access control6.9 Medium
- totolink a3000ru, a3000ru firmware +1 moreTOTOLINK A3000RU IBMS Configuration File ExportIbmsConfig.sh access control6.9 Medium
- mannaandpoem openmanusmannaandpoem OpenManus File file_saver.py execute access control4.8 Medium
- google gvisorImproper File Permission Handling in Google gVisor runsc6.8 Medium
- beijing honghu yuntu technology fast cad readerDylib Hijacking in Fast CAD Reader8.4 High
- netapp snapcenterCVE-2025-26512 Privilege Escalation Vulnerability in SnapCenter9.9 Critical
- totolink a3000ru, a3000ru firmware +1 moreTOTOLINK A3000RU Syslog Configuration File ExportSyslog.sh access control5.3 Medium
- mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 Backend admin doFilter access control6.9 Medium
- Show moreLoading…