CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- minitool partition wizardMiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control4.8 Medium
- eleveo call recording softwareEleveo Call Recording Software audio.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software composeEmailAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software pci_dss_status.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software group.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software sendlogfile improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software statisticReportAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software LDAP User users_ldap.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software Group roleAddAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software userAddAction.do improper authorization5.3 Medium
- sipeed picoclawSipeed PicoClaw Launcher access_control.go IPAllowlist access control6.9 Medium
- zen-browser desktopZen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction0.0 None
- totolink a3000ru, a3100r, a950rg +4 more +6 moreTOTOLINK EX200 Web boa.conf least privilege violation7.7 High
- d-link dir-823g, dlink dir-823g firmware +1 moreD-link DIR-823G Web boa.conf least privilege violation7.7 High
- manjurulhoque django-job-portalmanjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control5.3 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreIncorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.07.2 High
- gallagher command centre server, command centre +1 moreAn Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an...5.3 Medium
- craft cmsCraft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization5.3 Medium
- formbricksFormbricks Survey actions.ts access control6.9 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization6.9 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management6.9 Medium
- sourcecodester multi-vendor online grocery management systemSourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization5.3 Medium
- sourcecodester multi-vendor online grocery management systemSourceCodester Multi-Vendor Online Grocery Management System Users.php save_users improper authorization6.9 Medium
- weaviateWeaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment8.7 High
- aldo latino privatecontentWordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability9.8 Critical
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation8.8 High
- mycomplianceoffice mco, mycomplianceoffice +1 morePrivilege Escalation in MCO7.1 High
- cap-go capgoCapgo - Privilege Escalation via Cross-Scope RBAC Role Assignment8.7 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6.5 +1 more +3 moreKeycloak: keycloak: privilege escalation through hardcoded role mapper injection6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, redhat build of keycloak +2 moreKeycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper6.5 Medium
- deepmyst mystiDeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization2.3 Low
- code-projects inventory management systemSourceCodester Inventory Management System User Registration Endpoint users_handler.php access control6.9 Medium
- oppo o+ connectO+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.7.3 High
- feehi cmsFeehi CMS API users access control5.3 Medium
- cherryhq cherry-studioCherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization6.3 Medium
- No product listedVoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization2.3 Low
- freebsdFlaw in Linuxulator execution of setugid binaries7.1 High
- freebsdsigqueue(2) missing capability mode restriction6.5 Medium
- dokan proWordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability9.8 Critical
- david de boer paytiumWordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability9.8 Critical
- themewant easy elements for elementor – addons & website templatesWordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability9.8 Critical
- tyche softwares abandoned cart pro for woocommerceWordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability8.8 High
- themefusion fusion builderWordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability8.8 High
- fortra file integrity monitoring (fim), file integrity monitoring +1 morePrivilege Escalation in Fortra File Integrity Monitoring (FIM)4.4 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection10.0 Critical
- browserbase skillsBrowserbase Skills Autobrowse Trace Artifact default permission4.8 Medium
- cap-go capgoCapgo - Privilege Escalation via Broken Row Level Security in org_users7.0 High
- berriai litellmBerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization5.3 Medium
- ezbsystems ultraiso premium editionEzbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control8.5 High
- Show moreLoading…