CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- vvbbnn00 warp-clash-apivvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control5.3 Medium
- lenve vhrlenve vhr HrMapper.xml HrInfoController.updateHr privileges management5.3 Medium
- lenve vhrlenve vhr Password Update pass HrInfoController.updatePass improper authorization5.3 Medium
- internetdownloadmanager internet download managerTonec Internet Download Manager Kernel Driver idmwfp.sys access control9.3 Critical
- xuxueli xxl-jobXuxueli xxl-job JobGroupController.java privileges management5.3 Medium
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability8.8 High
- gato graphql graphqlWordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability8.8 High
- tubitak bilgem software technologies research institute pardus-softwarePrivilege Escalation in TUBITAK BILGEM's Pardus-software7.8 High
- siteskiteWordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability8.1 High
- everpure portworx operatorA privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP)....7.7 High
- seakee cpa-manager-plusseakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization6.9 Medium
- algosec horizon security analyzerLocal Privilege Escalation via Misconfigured Sudoers Entry in Horizon Security Analyzer6.1 Medium
- typo3 cmsTYPO3 CMS - Missing Authorization in lowlevel commands7.5 High
- multivendorx product catalog enquiry for woocommerce by multivendorxWordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability6.5 Medium
- elenavanengelenmaslova mocknest-serverlesselenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management5.1 Medium
- java-json-tools json-patchjava-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project...5.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege...8.8 High
- bookstackapp bookstackBookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control5.3 Medium
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management6.9 Medium
- No product listedJeecgBoot AiragModelController.java exportXls access control5.3 Medium
- No product listedOpen5GS AMF/MME improper authorization5.3 Medium
- tenda cp3Tenda CP3 Redirect.cpp SetRedirectEnable privileges management9.4 Critical
- stackstorm st2StackStorm st2 API Key auth.py privileges management5.3 Medium
- stackstorm st2StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management5.3 Medium
- dolibarrDolibarr Legacy File Manager config.inc.php access control5.3 Medium
- specterops bloodhoundSpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization5.3 Medium
- bricksforgeWordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability9.8 Critical
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability7.1 High
- liquidthemes booking hubWordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability8.8 High
- paul ryan authorizerWordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability9.8 Critical
- kimaiKimai before 2.65.0 Authentication Bypass via Team Creation5.3 Medium
- cleo harmonyCleo Harmony JWT Refresh Token connections privileges management6.9 Medium
- techjewel fluent forms pro add on packWordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability7.5 High
- caoqianming django-vue-admincaoqianming django-vue-admin file access control5.3 Medium
- doccano auto labeling pipeline module to annotate a document automatically, open source annotation tools for machine learning practitioners +1 moreDoccano Open Source Annotation Tools for Machine Learning Practitioners Bulk-Delete Endpoint category-types LabelList access control5.3 Medium
- doccano auto labeling pipeline module to annotate a document automatically, open source annotation tools for machine learning practitioners +1 moreDoccano Open Source Annotation Tools for Machine Learning Practitioners Project Example Detail Endpoint examples ExampleDetail access control5.3 Medium
- dibo-software dibootdibo-software diboot Tenant Resource Assignment resource access control5.3 Medium
- dibo-software dibootdibo-software diboot Tenant Administrator Management API admin access control5.3 Medium
- megaease easeprobeMegaEase EaseProbe Middleware server.go realIP access control6.9 Medium
- ieungsoft ultra ramdisk proieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management9.3 Critical
- iobit unlockerIObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management4.6 Medium
- iobit uninstallerIObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management4.8 Medium
- colorful igamecenterColorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management9.3 Critical
- lognet grpc-spring-boot-starterLogNet grpc-spring-boot-starter Annotation Processing improper authorization2.3 Low
- itsourcecode student management systemsambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization5.3 Medium
- siteserver sscmsSiteServer SSCMS Agent Installation Workflow access control2.3 Low
- wp manage ninja fluentcrm proWordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability7.2 High
- acpt (pro) - custom post types plugin for wordpressWordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability9.8 Critical
- cozmoslabs translatepressWordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability9.8 Critical
- Show moreLoading…