CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- im-magic partition resizerIM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control8.5 High
- easeus partition masterEaseUS Partition Master Kernel Driver EUEDKEPM.sys access control8.5 High
- easeus partition masterEaseUS Partition Master Kernel Driver epmntdrv.sys access control8.5 High
- aomei backupperAOMEI Backupper Kernel Driver amwrtdrv.sys access control8.5 High
- aomei dynamic disk managerAOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control8.5 High
- aomei partition assistantAOMEI Partition Assistant Kernel Driver ampa10.sys access control8.5 High
- berriai litellmBerriAI litellm M2M JWT user_api_key_auth.py improper authorization2.3 Low
- berriai litellmBerriAI litellm Admin Key key_management_endpoints.py improper authorization5.3 Medium
- mervinpraison praisonaiPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable8.8 High
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics Student Self-Registration Endpoint index.php access control6.9 Medium
- themegrill registration form for woocommerceWordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability9.8 Critical
- sbouey falang multilanguageWordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability8.8 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability6.8 Medium
- loginpress proWordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability9.8 Critical
- techspawn multilocaWordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability7.6 High
- theme passion support ticket management systemWordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability9.8 Critical
- jthemes genemyWordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability8.8 High
- sonaar music sonaarWordPress Sonaar theme <= 4.27.4 - Privilege Escalation vulnerability8.8 High
- schiocco support boardWordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability9.8 Critical
- openclawOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening2.3 Low
- openclawOpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope5.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreSandbox escape in the DOM: Workers component9.6 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 morePrivilege escalation in the Graphics: WebRender component8.8 High
- dokan, inc. dokanWordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability8.8 High
- latepointWordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability7.5 High
- webilia inc. listdomWordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability7.3 High
- ameliabooking ameliaWordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability8.8 High
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability8.1 High
- datalogics ecommerce delivery, unknown datalogics ecommerce delivery +1 moreWordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability9.8 Critical
- bplugins b blocksWordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability8.8 High
- brainstorm force woocommerce cart abandonment recoveryWordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability7.2 High
- paul icontrolwpWordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability9.8 Critical
- jordy meow ai engineWordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability7.2 High
- masteriyo - lms, themegrill masteriyo - lms +1 moreWordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability8.8 High
- dvdfab virtual driveDVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management8.5 High
- hcengineering huly platformhcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization5.3 Medium
- hcengineering huly platformhcengineering Huly Platform RPC operations.ts getMailboxSecret access control5.3 Medium
- iobit malware fighterIObit Malware Fighter DLL permission4.8 Medium
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 moreChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection8.8 High
- hippoo mobile app for woocommerce, hippooo hippoo mobile app for woocommerce +1 moreWordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability9.8 Critical
- openclawOpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority8.7 High
- duck-organization quest-botQuest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +5 more +7 more.NET SDK Elevation of Privilege Vulnerability7.8 High
- arm c1-premium, c1-ultra, cortex-a710 +45 more +47 moreArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,...9.1 Critical
- totolink ex200TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation6.9 Medium
- dolibarr erp crmDolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization5.3 Medium
- d-link dgs-1100-08pd, dlink dgs-1100-08pd firmware +1 moreD-Link DGS-1100-08PD Web boa.conf least privilege violation6.3 Medium
- totolink cp450TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation5.3 Medium
- imvks786 student management systemimvks786 student_management_system Student Deletion Endpoint see.php improper authorization5.3 Medium
- imvks786 student management systemimvks786 student_management_system Student Record add.php access control5.3 Medium
- Show moreLoading…