CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- yeqifu warehouseyeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control5.3 Medium
- portabilis i-educarPortabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization5.3 Medium
- publiccmsSanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization2.3 Low
- mayurik gas agency management systemSourceCodester Gas Agency Management System createUser.php access control5.3 Medium
- wekanWeKan REST Endpoint boards.js BoardTitleRESTBleed access control5.3 Medium
- wekanWeKan Attachment Storage attachments.js MoveStorageBleed access control5.3 Medium
- wekanWeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control5.3 Medium
- wekanWeKan LDAP User Sync syncUser.js SyncLDAPBleed access control5.3 Medium
- wekanWeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control5.3 Medium
- wekanWeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control5.3 Medium
- wekanWeKan REST API checklistItems.js Checklist REST Bleed improper authorization5.3 Medium
- wekanWeKan REST API boards.js setBoardOrgs improper authorization2.3 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api2.7 Low
- crmebZhong Bang CRMEB :uni tidyOrder improper authorization5.3 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software User Management user.php improper authorization5.3 Medium
- bdtask saleserpBdtask SalesERP Administrative Endpoint improper authorization5.3 Medium
- phpgurukul hospital management systemPHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization5.3 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART access control5.4 Medium
- e-plugins final userWordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability8.8 High
- e-plugins wp membershipWordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability8.8 High
- e-plugins hospital doctor directoryWordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability8.8 High
- e-plugins institutions directoryWordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability8.8 High
- lazycoders llc lazytasksWordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability9.8 Critical
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability7.3 High
- e-plugins lawyer directoryWordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability8.8 High
- booking activities team activitiesWordPress Booking Activities plugin <= 1.16.44 - Privilege Escalation vulnerability8.1 High
- jthemes xsmartWordPress xSmart theme <= 1.2.9.4 - Privilege Escalation vulnerability8.8 High
- wukongopensource wukongcrm, 5kcrm wukong crm +1 moreWuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization5.3 Medium
- mineadminMineAdmin View view improper authorization5.3 Medium
- phpgurukul news portalPHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization5.3 Medium
- publiccmsSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization5.3 Medium
- chamilo lmsChamilo LMS Legal Consent SocialController.php deleteLegal improper authorization5.3 Medium
- modular dsWordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability10.0 Critical
- visual-tools visual tools dvr vx16Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation8.5 High
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker with low privileges may be able to trigger critical system functions such as reboot...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker with limited permissions may still be able to write files to specific locations on...4.3 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreUploading unvalidated container images may allow remote attackers to gain full access to the...9.1 Critical
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker may gain unauthorized access to the host filesystem, potentially allowing them to...9.9 Critical
- modular ds dsWordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability10.0 Critical
- vertiv cyclades serial console serverCyclades Serial Console Server 3.3.0 - Local Privilege Escalation8.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Hello Tampering Vulnerability7.7 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Hello Tampering Vulnerability7.7 High
- tim-solutions tim flowAn issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to...5.3 Medium
- tim-solutions tim flowAn issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to...6.5 Medium
- dasinfomedia wpchurchWordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation Vulnerability8.8 High
- aa-team premium age verification / restriction for wordpress, responsive coming soon landing page / holding page for wordpress +1 morePrivilege Escalation Vulnerability in AA-Team WordPress plugins8.8 High
- yeqifu warehouseyeqifu warehouse Request UserController.java saveUserRole improper authorization5.3 Medium
- ateme flamingo xl, flamingo xl firmware +1 moreAnevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command8.6 High
- code-projects student file management systemcode-projects Student File Management System File Download download.php improper authorization5.3 Medium
- Show moreLoading…