CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedJeecgBoot SysAnnouncementController improper authorization5.3 Medium
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.1,...6.6 Medium
- cyber-iii student-management-systemCyber-III Student-Management-System HTTP POST Request update.php improper authorization6.9 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 Endpoint access control6.9 Medium
- dromara lamp-cloudDromara lamp-cloud DefUserController pageUser improper authorization5.3 Medium
- tenda 4g03 pro, 4g03 pro firmware +1 moreTenda 4G03 Pro httpd access control6.9 Medium
- bookstackapp bookstackBookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control6.9 Medium
- mayuri k best courier management systemSourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control6.9 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control6.9 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control6.9 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control5.3 Medium
- osrg gobgposrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control6.3 Medium
- osrg gobgposrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control6.3 Medium
- frrouting frr, frrouting +1 moreFRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control2.3 Low
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession6.1 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope8.7 High
- No product listedchatwoot Signup Endpoint login improper authorization6.9 Medium
- moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 moreMoby: Off-by-one error in plugin privilege validation6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +5 more +7 moreKeycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission6.5 Medium
- enter software iperius backupEnter Software Iperius Backup Backup Job Configuration File privileges management7.3 High
- devolutions serverIncorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This...5.8 Medium
- wpfunnels creator lmsWordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability8.8 High
- andrew munro / affiliatewp rewardswpWordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerability9.8 Critical
- bit apps smtpWordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability9.0 Critical
- wpeverest user registrationWordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability8.1 High
- uxper goloWordPress Golo theme <= 1.7.0 - Privilege Escalation vulnerability9.8 Critical
- iqonicdesign wpbookit proWordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability8.8 High
- wordpresschef salon booking system proWordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability8.1 High
- elated-themes search & goWordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerability9.8 Critical
- xagio seo seoWordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerability9.8 Critical
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability8.1 High
- cisco ios xe softwareA vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker...6.5 Medium
- sourcecodester patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorization6.9 Medium
- mickasmt next-saas-stripe-startermickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization5.3 Medium
- No product listedPbootCMS Backend UserController.php access control5.3 Medium
- rymera web co pty ltd. woocommerce wholesale lead captureWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability9.8 Critical
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control6.9 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G goahead UpdateClientInfo access control6.9 Medium
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead redirect.asp access control6.9 Medium
- openclawOpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate9.4 Critical
- openclawOpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes9.2 Critical
- sourcecodester web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add_admin.php improper authorization5.3 Medium
- pamzey patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System patient-search.php improper authorization6.9 Medium
- qi-anxin qax virus removal, qianxin qax internet control gateway +1 moreQi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control4.8 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System superadmin_user_update.php improper authorization6.9 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System Endpoint superadmin_delete_manager.php improper authorization6.9 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System Endpoint superadmin_user_delete.php improper authorization5.3 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software Financial Report improper authorization5.3 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization5.3 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System Endpoint fetch_manager_details.php improper authorization6.9 Medium
- Show moreLoading…