CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- hkuds nanobotHKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control5.1 Medium
- v-secure jingyun antivirusV-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control8.5 High
- avast antivirusJiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control8.5 High
- deepcool displayserviceDeepCool DisplayService DeepCoolDisplayService.exe access control8.5 High
- stablebit drivepoolStableBit DrivePool DrivePoolService DrivePool.Service.exe permission8.5 High
- stablebit scannerStableBit Scanner ScannerService Scanner.Service.exe permission8.5 High
- power sofware powerisoPower Sofware PowerISO Kernel Driver scdemu.sys privileges management8.5 High
- shabti frontend admin by dynamiappsWordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability9.8 Critical
- tychesoftwares order delivery date for woocommerceWordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability7.2 High
- sergey aiwuWordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability9.8 Critical
- publishpress capabilitiesWordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability7.2 High
- wpmu dev forminatorWordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability8.8 High
- mf-yang openclaw-cnmf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management5.3 Medium
- nanocoai nanoclawnanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management5.3 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization5.3 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Memory Toolset model_tools.py access control5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment5.3 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by security vulnerabilities in Model Context Protocol features8.8 High
- cisco terminal services agentCisco Terminal Services Agent Firewall Rules Bypass Vulnerability5.0 Medium
- red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.6 +2 more +4 moreCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token9.1 Critical
- baserow b.v. baserowBaserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization2.1 Low
- diaowen dwsurveydiaowen DWSurvey Survey Status up-survey-status.do improper authorization5.3 Medium
- kalcaddle kodboxkalcaddle kodbox msgWarning Plugin action improper authorization6.9 Medium
- razer rzupdateserviceRazer RzUpdateService Named Pipe RzUpdateService.exe privileges management8.5 High
- gl.inet e5800, e750, x2000 +3 more +5 moreGL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization5.3 Medium
- containers fuse-overlayfsfuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)2.0 Low
- nanocoai nanoclawnanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization5.3 Medium
- nanocoai nanoclawnanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization4.8 Medium
- nousresearch hermes-agentNousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control2.3 Low
- owap defectdojoOWASP DefectDojo API/Web serializers.py UserSerializer privileges management5.3 Medium
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability9.8 Critical
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability8.8 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability9.8 Critical
- gitea open source git serverGitea LFS Deploy-Key Privilege Escalation5.4 Medium
- kubeflow community-distributionKubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing8.0 High
- craftcms commerceA privilege escalation vulnerability affects HCL Commerce8.8 High
- jxxghp moviepilotjxxghp MoviePilot Application API improper authorization5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization5.3 Medium
- labring fastgptFastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows9.3 Critical
- waooai waoowaoowaooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization6.3 Medium
- properfraction mailoptinWordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability9.8 Critical
- favethemes houzez login registerWordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability8.2 High
- mailerpress team mailerpressWordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability8.8 High
- kodezen llc ablocksWordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability8.8 High
- leantimeLeantime API saveSetting improper authorization5.3 Medium
- leantimeLeantime JSON-RPC Endpoint addUser improper authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization5.3 Medium
- qiling disk masterQILING Disk Master Kernel Driver diskbckp.sys access control4.8 Medium
- Show moreLoading…