CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- pamzey patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System checkin.php improper authorization5.3 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 com.dgen.alarm improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control2.3 Low
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorization4.8 Medium
- designthemes lms elementor proWordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability9.8 Critical
- josh kohlbach wholesale suiteWordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability7.2 High
- ameliabooking ameliaWordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability7.2 High
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1,...6.7 Medium
openclawnpmOpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt7.3 High- dataease sqlbotDataease SQLBot API Endpoint assistant.py access control5.3 Medium
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators4.9 Medium
- psi-probe psi probepsi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control5.3 Medium
- go2ismail free-crmgo2ismail Free-CRM Security API improper authorization5.3 Medium
- go2ismail asp.net-core-inventory-order-management-systemgo2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization5.3 Medium
- fosrl pangolinfosrl Pangolin Role verifyApiKeyRoleAccess access control5.3 Medium
- nvidia cumulus linux, nvos, cumulus linux ga +1 more +3 moreNVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low...8.0 High
- munyweki student result management systemSourceCodester Student Result Management System Bulk Import import_users.php access control6.9 Medium
- munyweki student result management systemSourceCodester Student Result Management System update_smtp.php access control6.9 Medium
- funadminfunadmin Configuration Ajax.php setConfig improper authorization6.9 Medium
- feng ha ha ssm-erp, production ssm +1 morefeng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Sales Endpoint SalesController.java deleteSales access control5.3 Medium
- yeqifu warehouseyeqifu warehouse Inport Endpoint InportController.java deleteInport access control5.3 Medium
- yeqifu warehouseyeqifu warehouse Customer Endpoint CustomerController.java deleteCustomer access control5.3 Medium
- yeqifu warehouseyeqifu warehouse Cache Sync CacheController.java syncCache access control5.3 Medium
- xforwoocommerce product filter for woocommerceWordPress Product Filter for WooCommerce plugin <= 9.1.2 - Privilege Escalation vulnerability7.2 High
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege...8.1 High
- dell powerprotect data managerDell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege...6.3 Medium
- cocoteanet cyreneadminCoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorization5.3 Medium
- googtech sms-ssmGoogTech sms-ssm API LoginInterceptor.java preHandle improper authorization5.3 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform User delete access control6.9 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform User add access control6.9 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform api access control6.9 Medium
- jingdong jd cloud box ax6600, jdcloud ax6600 firmware +1 moreJingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges management5.3 Medium
- jingdong jd cloud box ax6600, jdcloud ax6600 firmware +1 moreJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi cast_streen privileges management5.3 Medium
- jingdong jd cloud box ax6600, jdcloud ax6600 firmware +1 moreJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges management5.3 Medium
- zhanghuanhao librarysystem 图书馆管理系统zhanghuanhao LibrarySystem 图书馆管理系统 BookController.java access control6.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.13, build of keycloak 26.4 +1 more +3 moreKeycloak: incorrect ownership checks in /uma-policy/5.4 Medium
- wekanWeKan Custom Translation translationBody.js setCreateTranslation improper authorization5.3 Medium
- wekanWeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control5.3 Medium
- jsbroks coco annotatorjsbroks COCO Annotator Delete Category undo improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Department Management DeptController.java deleteDept improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Role Management RoleController.java deleteRole improper authorization5.3 Medium
- Show moreLoading…