CWE-267: Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- asterisk, asterisk certified-asterisk +1 more Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes 8.1 High
- drupal custom formatters Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 7.2 High
- colorful igamecenter Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions 9.3 Critical
- theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 more Foreman: excessive permissions for viewer role on preview 9.1 Critical
- drupal editoria11y accessibility checker Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 4.3 Medium
- drupal webform Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 5.4 Medium
- drupal webform Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 4.6 Medium
- drupal webform Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 3.1 Low
- ibm i IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH [] 3.3 Low
- content moderation notifications project moderation notifications, drupal content moderation notifications +1 more Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 3.3 Low
- ibm ds8900f ( r9.4), ds8900f firmware, ds8a00( r10.0 - r10.1 ) +1 more +3 more DS8900F and DS8A00 Privilege Escalation 7.5 High
- red hat openshift ai 3.3, openshift ai 3.4, openshift ai 3.5 +2 more Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole 8.8 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 more Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription 9.0 Critical
- drupal tfa basic plugins, tfa basic plugins project basic plugins +1 more TFA Basic Plugins - Access Bypass 5.1 Medium
- openvpn connect Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS... 9.4 Critical
- f5 big-ip, big-iq, big-ip access policy manager +21 more +23 more BIG-IP and BIG-IQ privilege escalation vulnerability 8.5 High
- No product listed In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a... 9.8 Critical
- apache cassandra Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass 8.8 High
- hitachi energy relion reb500, hitachienergy reb500 firmware +1 more A vulnerability exists in REB500 for an authenticated user with low-level privileges to access... 7.6 High
- hitachi energy relion reb500, hitachienergy reb500 firmware +1 more A vulnerability exists in REB500 for an authenticated user with Installer role to access and... 7.4 High
- uni-yaz flexcity, universal software inc. flexcity/kiosk +1 more Business Logic Error in Universal Software's FlexCity/Kiosk 8.8 High
- cvat-ai cvat, cvat computer vision annotation tool +1 more CVAT vulnerable to privilege escalation of users with staff status 8.5 High
- drupal role delegation, role delegation project delegation +1 more Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002 8.8 High
- drupal mini site Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117 5.4 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 more Kiteworks MFT has a Privilege Defined With Unsafe Actions 6.5 Medium
- oracle vm virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ... 8.2 High
- oracle vm virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ... 6.0 Medium
- oracle vm virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ... 8.2 High
- oracle vm virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ... 8.2 High
- oracle vm virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ... 8.2 High
- oracle vm virtualbox Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ... 8.2 High
- oracle zfs storage appliance kit Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component:... 2.7 Low
- oracle zfs storage appliance kit Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block... 2.7 Low
- oracle zfs storage appliance kit Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component:... 4.9 Medium
- oracle health sciences data management workbench Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health... 4.9 Medium
- oracle bi publisher Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API)... 6.5 Medium
- oracle solaris Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The... 5.5 Medium
- broadcom vmware aria operations and vmware tools, vmware aria operations, tools +7 more +9 more VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) 7.8 High
- gitlab Privilege Defined With Unsafe Actions in GitLab 6.5 Medium
- apache cassandra Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) 8.8 High
- wftpserver wing ftp server, wing ftp server ftp server +1 more In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port... 4.1 Medium
- drupal two-factor authentication (tfa), two-factor authentication project authentication +1 more Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085 6.5 Medium
- perforce delphix Privilege Chaining in Delphix 8.5 High
- apache cassandra Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions 8.8 High
- No product listed An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service,... 8.8 High
- ivanti secure access client Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated... 7.8 High
- ivanti secure access client Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local... 7.3 High
- ivanti secure access client Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local... 7.1 High
- ivanti connect secure, policy secure +1 more Excessive binary privileges in Ivanti Connect Secure which affects versions 22.4R2 through 22.7R2... 7.8 High
- gitlab Privilege Defined With Unsafe Actions in GitLab 5.5 Medium
- Show olderLoading…