CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- mohammed-eid35 bank-management-system-springbootMohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization5.3 Medium
- sourcecodester inventory systemSourceCodester Inventory System Account Creation users_handler.php improper authorization5.3 Medium
- d-link dcs-5615, dlink dcs-5615 firmware +1 moreD-Link DCS-5615 Boa Webserver boa.conf least privilege violation6.9 Medium
- totolink ac1200 t8TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation5.3 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G vsftpd vsftpd.conf least privilege violation5.3 Medium
- cyber-iii student-management-systemKushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization5.3 Medium
- zilliztech deep-searcherzilliztech deep-searcher collection_router.py CollectionRouter.invoke access control5.3 Medium
- chengdu everbrite network technology beikeshopChengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization6.9 Medium
- theonedev onedevtheonedev Pull Request issues canAccessIssue improper authorization5.3 Medium
- theonedev onedevtheonedev REST API default-branch improper authorization5.3 Medium
- theonedev onedevtheonedev Parent Project projects improper authorization5.3 Medium
- theonedev onedevtheonedev projects improper authorization5.3 Medium
- tittuvarghese collegemanagementsystemtittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization5.3 Medium
- sourcecodester ship ferry ticket reservation systemSourceCodester Ship Ferry Ticket Reservation System admin improper authorization5.3 Medium
- mojoomla school managementWordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability8.8 High
- sourcecodester online boat reservation systemSourceCodester Online Boat Reservation System Administrative Endpoint improper authorization5.3 Medium
- themeisle masteriyo lms proWordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability9.8 Critical
- packagekitPackageKit API pk-transaction.c g_file_test improper authorization5.3 Medium
- devaslanphp project-managementDevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization5.3 Medium
- devaslanphp project-managementDevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization5.3 Medium
- bottelet daybydaycrmBottelet DaybydayCRM DocumentsController.php view improper authorization5.3 Medium
- j3k0 mcp-google-workspacej3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control5.3 Medium
- a4m4 student-management-systema4m4 Student-Management-System deleteform.php improper authorization6.9 Medium
- decolua 9routerdecolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization5.3 Medium
- unknown contest gallery proWordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability9.8 Critical
- sergey aiwuWordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability9.8 Critical
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control6.9 Medium
- sourcecodester water billing management systemSourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw evolution_handlers.go auth improper authorization5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management5.3 Medium
- dolibarr erp crmDolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization5.3 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java access control5.3 Medium
- macrozheng mallmacrozheng mall Super Admin Password update improper authorization5.1 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation via improper scope mapping enforcement7.3 High
- openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +2 more +4 moreOpenStack Keystone has an Incorrect Authorization issue6.0 Medium
- saleswonder llc webinarignitionWordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability9.8 Critical
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability9.8 Critical
- No product listedJeecgBoot AiragModelController access control5.3 Medium
- No product listedJeecgBoot add access control5.3 Medium
- No product listedJeecgBoot selectDepart LoginController.selectDepart access control6.9 Medium
- No product listedJeecgBoot SysUser userEdit user.getUsername access control5.3 Medium
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control6.9 Medium
- devolutions server, mariadb, red hat enterprise linux 10 +4 more +6 moreMariaDB: FILE privilege was not checked for subqueries in the FROM clause5.0 Medium
- hemant6488 codeigniter-studentmanagementsystemhemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control6.9 Medium
- storeapps smart managerWordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability8.8 High
- sourcecodester student grades management systemSourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorization5.3 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System grades.php improper authorization5.3 Medium
- sourcecodester indian invoicing systemSourceCodester Indian Invoicing System Backend Endpoint access control5.3 Medium
- sushmi-pal invoice-systemSushmi-pal Invoice-System Profile Workflow profile improper authorization5.3 Medium
- sushmi-pal invoice-systemSushmi-pal Invoice-System User Management user improper authorization5.3 Medium
- Show moreLoading…