CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- mitsubishi electric corporation analytix, genesis64, hyper historian +3 more +5 moreAn arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works649.4 Critical
- giteaGitea repository ownership escalation by administrators6.5 Medium
- giteaGitea API token scope escalation through HTTP signatures8.1 High
- giteaGitea organization team policy bypass through repository API6.5 Medium
- m a vinoth kumar frontend dashboardWordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability9.8 Critical
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability6.1 Medium
- docker hubDocker Hub account conversion could reassign an active personal access token to another user9.4 Critical
- sourcecodester simple cafe billing systemSourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization6.9 Medium
- huawei openbmcHuawei openUBMC low-privilege SNMP to administrator privilege escalation5.4 Medium
- colorful igamecenterColorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions9.3 Critical
- siemens simatic wincc v7.5, simatic wincc v8.0, simatic wincc v8.1 +2 moreA vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All...8.7 High
- calcom cal.com, cal.diy +1 morecalcom cal.com/cal.diy Credentials delete credentials.delete privileges management5.3 Medium
- gitlabIncorrect Privilege Assignment in GitLab4.3 Medium
- 1024-lab smart-admin1024-lab smart-admin Support Config Query queryByKey access control5.3 Medium
- tobychui zoraxytobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization6.9 Medium
- blackbelttechnology pi-agent-dashboardBlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization5.3 Medium
- yungengxin yun jia security guardYungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management4.8 Medium
- yangzongzhuan ruoyiyangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management5.3 Medium
- No product listedSEMCMS SEMCMS_User.php user improper authorization6.9 Medium
- zkteco biotimeZKTeco BioTime System Settings API systemSettings access control5.3 Medium
- berriai litellmBerriAI LiteLLM Secret Resolution main.py get_secret improper authorization5.3 Medium
- select-themes tonda membershipWordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability9.8 Critical
- sergey aiwuWordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability9.8 Critical
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability8.2 High
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability9.8 Critical
- automattic woocommerceWordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability7.2 High
- ultimate member memberWordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability5.6 Medium
- progress software telerik report serverPrivilege Escalation in Telerik Report Server Service-Agent Hub7.1 High
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability8.8 High
- john james jacoby wp user profilesWordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability8.8 High
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability7.2 High
- nexcess givewpWordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability8.1 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability8.1 High
- publishpress capabilitiesWordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability7.2 High
- dexignzone jobzilla - job board wordpress themeWordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability8.8 High
- tourfic ai studio proWordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability8.8 High
- amentotech doctreat coreWordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability10.0 Critical
- ohidul islam challanWordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability7.2 High
- elightup meta box aio, meta box aio +1 moreWordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability9.8 Critical
- amentotech taskbotWordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability9.8 Critical
- jishenghua jsherpjishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization5.3 Medium
- chillzhuang springbladechillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization5.1 Medium
- chillzhuang springbladechillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization5.1 Medium
- No product listedPickMall Lilishop Mobile Binding bindMobile improper authorization6.9 Medium
- onetwothreeneth hospitalmanagementsystemonetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization6.9 Medium
- totolink a3002muTotolink A3002MU Authentication Check boa sub_40FCFC improper authorization10.0 Critical
- bytecore stack bytecorestack – mcp connector for ai toolsWordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability8.8 High
- paul ryan authorizerWordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability9.8 Critical
- tryghost ghostGhost 2.21.0 before 6.56.0 Privilege Escalation via Notifications8.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group...6.6 Medium
- Show moreLoading…