CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- david-crty databasementDavid-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control5.3 Medium
- immich-app immichimmich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization6.9 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Incorrect Privilege Assignment7.2 High
- internet2 grouperIn Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or...9.3 Critical
- surecartWordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability7.2 High
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability6.3 Medium
- appsbd viteposWordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability7.2 High
- estatikWordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability9.8 Critical
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability7.5 High
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Configuration sistem.php simpan improper authorization5.1 Medium
- electronElectron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions8.2 High
- realjerrytang tacomallrealjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization6.9 Medium
- raspap raspap-webguiRaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management8.7 High
- eleveo call recording softwareEleveo Call Recording Software Query Builder searchAction.do access control5.3 Medium
- suse rancher, rancher fleet +1 moreFleet applies namespace labels and annotations without the bundle's service account privileges6.5 Medium
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control6.9 Medium
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control6.9 Medium
- krayin laravel-crmKrayin laravel-crm acl.php access control5.3 Medium
- cap-go capgo.appCapgo OTA Manifest Poisoning via app_versions.manifest Bypass8.7 High
- krayin laravel-crmkrayin laravel-crm User Management UserController.php privileges management5.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization6.9 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization6.9 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization6.9 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization6.9 Medium
- kvcache-ai mooncakekvcache-ai mooncake MountSegment Request Processing segment.cpp access control5.3 Medium
- carazo import and export users and customersImport and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile F…8.8 High
- neethuharii cafemanagementNeethuharii CafeManagement AddCashierCode.php addcashier improper authorization6.9 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames6.6 Medium
- moore threads mtt s80 driver packageMoore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management9.3 Critical
- codeastro qr code attendance management systemCodeAstro QR Code Attendance Management System UserController.php save privileges management5.1 Medium
- mcphubsamanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management5.3 Medium
- d-link dir-x1860, dir-x1860z +1 moreD-Link DIR-X1860/DIR-X1860Z routerd ubus access control8.7 High
- aiyiyi121 sxdevopsaiyiyi121 SxDevOps UserSerializer serializers.py update privileges management5.1 Medium
- dromara ujcmsDromara UJCMS UserController UserController.java usernameExist improper authorization6.9 Medium
- agronholm anyioAnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups7.0 High
- No product listedSveltyCMS User Attribute Update Endpoint +server.ts access control5.3 Medium
- arista networks eosSecurity Advisory 01639.4 Critical
- flowiseai flowiseFlowise before 3.1.4 Cross-Tenant Organization Admin Takeover7.7 High
- sourcecodester college notes gallery management systemSourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management6.9 Medium
- phpgurukul hostel management systemPHPGurukul Hostel Management System checklogin.php access control5.3 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment5.3 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization5.3 Medium
- aws iam-identity-center-teamIncorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center8.6 High
- soarkey studentmanagementSoarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management6.9 Medium
- apache software foundation syncopeApache Syncope: Privilege escalation for admin user via JWT authentication9.8 Critical
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system Registration register.php createUserAccount improper authorization6.9 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system dashboard.php access control6.9 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management6.9 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization5.3 Medium
- phpgurukul bank locker management systemPHPGurukul Bank Locker Management System sidebar.php access control5.3 Medium
- Show moreLoading…