CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- jeecg bootJeecgBoot getPositionUserList improper authorization2.3 Low
- jeecg bootJeecgBoot queryDepartPermission improper authorization2.3 Low
- jeecg bootJeecgBoot list getParameterMap improper authorization2.3 Low
- jeecg bootJeecgBoot datarule improper authorization2.3 Low
- jeecg bootJeecgBoot datarule loadDatarule improper authorization2.3 Low
- jeecg bootJeecgBoot getDeptRoleList improper authorization2.3 Low
- jeecg bootJeecgBoot list queryPageList improper authorization2.3 Low
- macrozheng mallmacrozheng mall Member Endpoint update improper authorization5.3 Medium
- getmaxun maxungetmaxun Authentication Endpoint auth.ts router.get improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall OrderController.java submitOrderPayment improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall MemberController.java getMemberByMobile access control5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall Balance MemberController.java deductBalance improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control2.3 Low
- devolo ag dlan 550 duo+ starter kitdevolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr8.7 High
- microhard systems 3g/4g cellular ethernet and serial gateway remote root exploit, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface8.7 High
- zillya total securityZillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine Module8.5 High
- https://github.com/mkj/dropbear/ dropbearDropbear: privilege escalation via unix domain socket forwardings5.4 Medium
- campcodes advanced voting management systemCampcodes Advanced Voting Management System Password voters_edit.php improper authorization5.3 Medium
- pencidesign soledadWordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerability9.8 Critical
- jthemes sale! immigration law, visa services support, migration agent consultingWordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability8.8 High
- e-plugins hotel listingWordPress Hotel Listing plugin <= 1.4.0 - Privilege Escalation vulnerability8.8 High
- wpxpo postxWordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability7.2 High
- silverplugins217 custom fields account registration for woocommerceWordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability7.2 High
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 ONVIF PTZ Control device_service access control5.3 Medium
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 ONVIF Device Management Service device_service access control5.3 Medium
- amazon harmonix, aws harmonix on aws +1 moreOverly Permissive Trust Policy in Harmonix on AWS EKS8.6 High
- red hat openshift gitops, redhat-developer gitops-operator, red hat openshift gitops 1.16 +2 more +4 moreOpenshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs9.1 Critical
- decocms meshDecoCMS Mesh Workspace Domain api.ts createTool access control6.3 Medium
- chmln sdsd changes the group ownership of the source file8.4 High
- senior-walter online student clearance systemSourceCodester Online Student Clearance System Fee Table delete-fee.php improper authorization6.9 Medium
- aureus erpHimool ERP AdminActionViewSet update_account improper authorization5.3 Medium
- ketr jepaasketr JEPaaS load improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall openid access control5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall members getMemberById access control5.3 Medium
- macrozheng mall-swarmmacrozheng mall-swarm delete improper authorization5.3 Medium
- yzcheng90 x-springbootThis vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role...7.3 High
- acustica-audio aquarius helpertoolThe Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that...5.1 Medium
- getgrav gravGrav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover8.8 High
- orionsec orion-ops, orion ops +1 moreorionsec orion-ops User Profile UserController.java update improper authorization6.9 Medium
- orionsec orion-ops, orion ops +1 moreorionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization5.3 Medium
- nutzam nutzbootnutzam NutzBoot Transaction API EthModule.java improper authorization6.9 Medium
- zentaoZenTao File control.php delete privileges management5.3 Medium
- No product listedInsecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to...8.8 High
- openbaoOpenBao Privileged Operator Identity Group Root Escalation7.5 High
- code-projects blog sitecode-projects Blog Site admin.php improper authorization5.3 Medium
- black duck scaBlack Duck SCA Project Privilege Escalation5.3 Medium
- grafana, grafana enterprise +1 moreIncorrect privilege assignment10.0 Critical
- macrozheng mallmacrozheng mall delete access control5.3 Medium
- wbce cmsWBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)8.7 High
- datax-web project datax-webWeiYe-Jing datax-web Job triggerJob access control5.3 Medium
- Show moreLoading…