CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- sonarrSonarr Service Sonarr.Console.exe default permission8.5 High
- No product listedRadarr Service Radarr.Console.exe default permission8.5 High
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm paySuccess improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall cancelOrder improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall cancelUserOrder improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall Order Details detail improper authorization5.3 Medium
- macrozheng mall-swarmmacrozheng mall-swarm attr updateAttr improper authorization5.3 Medium
- rhobs observability-operator, red hat cluster observability operator 1.3.1 +1 moreObservability-operator: observability operator privilege escalation8.8 High
- siemens spectrum power 4A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The...8.5 High
- chipsalliance rocketchipA vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the...6.5 Medium
- No product listedAn issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level...6.5 Medium
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability9.8 Critical
- uxper togoWordPress Togo theme < 1.0.4 - Privilege Escalation vulnerability8.8 High
- holest engineering selling commander for woocommerceWordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerability9.8 Critical
- vito peleg atarimWordPress Atarim plugin <= 4.2.1 - Privilege Escalation vulnerability9.8 Critical
- bplugins advanced scrollbarWordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability8.8 High
- nagios log serverNagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root8.5 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.0 +2 moreOpenshift-ai: trusty ai grants all authenticated users to list pods in any namespace5.0 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM incorrect privilege assignment7.8 High
- dulaiduwang003 time-sea-plusdulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization5.3 Medium
- bplugins voice feedbackWordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability8.8 High
- fantasticplugins sumo memberships for woocommerceWordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability8.8 High
- pebas couponxxlWordPress CouponXxL theme <= 3.0.0 - Privilege Escalation vulnerability9.8 Critical
- extendons woocommerce registration fields plugin - custom signup fieldsWordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerability8.8 High
- goodlayers coreWordPress Goodlayers Core plugin < 2.1.7 - Privilege Escalation vulnerability8.8 High
- n-media simple user registrationWordPress Simple User Registration plugin <= 6.8 - Privilege Escalation vulnerability8.8 High
- dokan, inc. dokanWordPress Dokan plugin <= 4.1.3 - Privilege Escalation vulnerability7.2 High
- josh kohlbach wholesale suiteWordPress Wholesale Suite plugin <= 2.2.4.2 - Privilege Escalation vulnerability7.2 High
- progress planner plannerWordPress Progress Planner plugin <= 1.8.0 - Privilege Escalation vulnerability8.8 High
- restaurant brands international assistant platform, rbi restaurant brands international assistant +1 moreThe Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote...9.9 Critical
- sismics teedySismics Teedy API Endpoint file access control5.3 Medium
- hp, inc. sound researchSound Research SECOMNService Escalation of Privilege8.5 High
- hp, inc. sound researchSound Research SECOMNService Escalation of Privilege8.5 High
- letscms binary mlm planBinary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalation6.5 Medium
- tomofun furbo 360, furbo mini, furbo 360 dog camera firmware +1 more +3 moreTomofun Furbo 360/Furbo Mini GATT Service access control5.3 Medium
- tomofun furbo 360, furbo mini, furbo 360 dog camera firmware +1 more +3 moreTomofun Furbo 360/Furbo Mini Trial Restriction access control1.0 Low
- portabilis i-educarPortabilis i-Educar User Type AccessLevelController.php insecure inherited permissions5.3 Medium
- jhumanj opnformJhumanJ OpnForm edit access control5.3 Medium
- denoDeno's --deny-write check does not prevent permission bypass3.3 Low
- dell data domain operating system, powerprotect data domain boostfs for linux ubuntu feature release, powerprotect data domain boostfs for linux ubuntu lts2023 +2 more +4 moreDell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1...7.5 High
- frappe lms, learning +1 moreFrappe LMS Unpublished Course courses access control2.3 Low
- seriawei zkeacmsSeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization5.3 Medium
- opendatahub-io opendatahub-operator, red hat openshift ai 2.16, openshift ai 2.19 +3 more +5 moreOpenshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin9.9 Critical
- zhuimengshaonian wisdom-educationzhuimengshaonian wisdom-education ExamInfoController.java selectStudentExamInfoList improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar periodo-lancamento improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar unificacao-aluno improper authorization5.3 Medium
- syslifters sysreptorSysReptor Susceptible to Privilege Escalation by Authenticated Users8.1 High
- portabilis i-educarPortabilis i-Educar consulta-dispensas improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar aluno improper authorization5.3 Medium
- code-projects employee management systemTutorials-Website Employee Management System HTTP Request all-applied-leave.php improper authorization6.9 Medium
- Show moreLoading…