CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- besen bs20 ev charging stationBesen BS20 EV Charging Station OTA Update Installation improper authorization9.2 Critical
- guizhou xiaoma technology jpressJPress UCenter Article Submission Endpoint doWriteSave improper authorization5.3 Medium
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment...5.3 Medium
- litespeed cpanel plugin, litespeed technologies whm plugin, litespeedtech litespeed cpanel plugin +1 more +3 moreLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as...10.0 Critical
- thorsten phpmyfaqphpMyFAQ - Insecure Direct Object Reference in User Password API8.7 High
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control6.9 Medium
- No product listedZ-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization5.3 Medium
- open5gsOpen5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization5.3 Medium
- comarch erp optimaPrivilege Escalation in Comarch ERP Optima7.5 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreiControl SOAP vulnerability7.1 High
- industrial application software ias canias erpIndustrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization6.9 Medium
- dotouch xproupfDotouch XproUPF access control2.1 Low
- naver mybox explorer, navercorp mybox +1 moreNAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges...7.8 High
- elunez eladmineladmin Users API Endpoint UserController.java checkLevel access control5.3 Medium
- cisa manage.get.govCISA manage.get.gov insecure portfolio administrative privileges5.1 Medium
- openclawOpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions2.3 Low
- geovision gv-lpc2011 firmware, gv-lpc2211 firmware, geovision inc. gv-lpc2011/lpc2211 +2 moreGeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerability9.9 Critical
- crocodilestick calibre-web-automatedcrocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization5.3 Medium
- janeczku calibre-webjaneczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization5.3 Medium
- eyeo adblock pluseyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control6.9 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization6.9 Medium
- code-projects online hospital management systemcode-projects Online Hospital Management System Registration improper authorization5.3 Medium
- No product listedJeecgBoot FillRuleUtil edit improper authorization5.3 Medium
- nextlevelbuilder goclaw, goclaw lite +1 morenextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization6.9 Medium
- 1024-lab smart-admin1024-lab smart-admin Demo Site index.html access control6.9 Medium
- tubitak bilgem software technologies research institute pardus software centerImproper Access Control in TUBITAK BILGEM's Pardus Software Center8.8 High
- No product listedo2oa NodeAgent NodeAgent.java syncFile improper authorization6.3 Medium
wooeyPyPIWooey API Endpoint scripts.py add_or_update_script improper authorization5.3 Medium- directorist social loginWordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability9.8 Critical
- code-projects invoice system in laravelcode-projects Invoice System in Laravel API Endpoint item improper authorization6.9 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization5.3 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel Profile profile improper authorization5.3 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel User Management user improper authorization5.3 Medium
- vanna-ai vannavanna-ai vanna Legacy Flask API improper authorization6.9 Medium
- esri portal for arcgisIncorrect privilege assignment in Portal for ArcGIS9.8 Critical
- esri portal for arcgisIncorrect privilege assignment in Portal for ArcGIS9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 morePrivilege escalation in the Graphics: WebRender component8.8 High
- usememos memosusememos UpdateInstanceSetting App.tsx memos_access_token improper authorization5.3 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog views.py form_valid improper authorization5.3 Medium
- collabora kodexplorerCollabora KodExplorer fileUpload Endpoint share.class.php improper authorization6.3 Medium
- emq emqx enterpriseEMQ EMQX Enterprise Session Handling improper authorization5.3 Medium
- openclawOpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools7.1 High
- openclawOpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes6.0 Medium
- openclawOpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint7.1 High
- openclawOpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches7.6 High
- silverstripe silverstripe-assetsSilverstripe Assets Module has a DBFile::getURL() permission bypass5.3 Medium
- decidimDecidim amendments can be accepted or rejected by anyone7.5 High
- siemens ruggedcom crossbow secure access manager primary (sam-p)A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) ...8.7 High
- codeastro online job portalCodeAstro Online Job Portal Delete Job Posting job-delete.php access control5.3 Medium
- perfree go-fastdfs-webperfree go-fastdfs-web doInstall InstallController.java improper authorization6.9 Medium
- Show moreLoading…