CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- liquidthemes booking hubWordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability8.8 High
- hclsoftware hcl hiveHCL Hive is affected by a broken access control vulnerability7.2 High
- mvpthemes jawnWordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability9.8 Critical
- redefiningtheweb affiliate pro - affiliate program for woocommerce & wordpressWordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability9.8 Critical
- unitedover, llc digitsWordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability9.8 Critical
- No product listedOpen5GS AMF UEContextReleaseRequest Path improper authorization5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization5.3 Medium
- dromara ruoyi-vue-plusDromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization5.3 Medium
- dolibarrDolibarr Account card.php improper authorization5.3 Medium
- aws athena federated query clickhouse connector deployment templateIncorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template7.1 High
- elunez eladminelunez eladmin GenConfigController improper authorization5.3 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization5.3 Medium
- tyche softwares abandoned cart pro for woocommerceWordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability9.8 Critical
- themegoods capellaWordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability9.8 Critical
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreFreeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships9.6 Critical
- binti76 total donationsWordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability9.8 Critical
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability9.8 Critical
- xianrendzw easyreportxianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission5.3 Medium
- psm plugins supportcandyWordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability8.2 High
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability6.3 Medium
- theme-one the gridWordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability8.8 High
- No product listedOpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization5.3 Medium
- No product listedBerkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a...7.8 High
- red hat openshift ai 3.4Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation7.9 High
- webkul bagistoWebkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management5.3 Medium
- No product listedAdblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization5.3 Medium
- No product listedOpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management5.3 Medium
- spacex starlink router gen 3SpaceX Starlink Router Gen 3 gRPC Management get_status access control5.3 Medium
- d-link dir-842D-Link DIR-842 vsftpd vsftpd.conf default permission2.3 Low
- trendnet tew-813druTRENDNET TEW-813DRU vsftpd vsftpd.conf default permission2.3 Low
- webkul bagistoWebkul Bagisto Customer Item Deletion Endpoint access control5.1 Medium
- getgrav grav-plugin-apiGrav API Plugin before 1.0.13 Scope Bypass via createApiKey8.7 High
- openwrt luciOpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write8.7 High
- filebrowserfilebrowser through 2.63.16 Privilege Escalation via Signup9.3 Critical
- onokazu directories proWordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability7.7 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability9.8 Critical
- miniorange saml sp single sign onWordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability8.1 High
- aonetheme service finder bookingWordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability8.8 High
- fluxbuilder mstore api, mstore api +1 moreWordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability8.1 High
- gitlabIncorrect Privilege Assignment in GitLab3.3 Low
- pleskIncorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a...9.3 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache5.3 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation8.8 High
- red hat ai inference server, openshift ai 2.25, openshift ai 3.3 +1 more +3 moreData-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening7.6 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreTrustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override8.1 High
- kingston fury ctrl rgb control softwareKingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management8.5 High
- uasoft badasoUasoft Badaso File API api.php class permission6.9 Medium
- wongcyrus excellexbotwongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management5.1 Medium
- nxp-auto-goldvip gvipnxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control5.1 Medium
- 3coresec trapdoor3CORESec Trapdoor DefaultFunction access control5.3 Medium
- Show moreLoading…