CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- edubusinesssolutions print shop pro webdeskAn issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 allows a remote attacker to...9.8 Critical
- keystorage global facilities management softwareAn issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote...9.4 Critical
- formwork project formworkFormwork Improperly Manages Privileges During User Creation8.8 High
- nestersoft worktime, nestersoft inc. worktime (on-prem/cloud) +1 moreLocal Privilege Escalation in NesterSoft WorkTime7.8 High
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptionss2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- scriptsbundle buyentBuyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration9.8 Critical
- buddhathemes lizza lms proLizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation9.8 Critical
- toret managerToret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions8.8 High
- smartdatasoft clasifico listingClasifico Listing <= 2.0 - Unauthenticated Privilege Escalation9.8 Critical
- hewlett packard enterprise (hpe) hpe aruba networking clearpass policy managerLocal Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for Linux7.8 High
- openclawOpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command7.2 High
- No product listedMalwarebytes AdwCleaner before v.8.7.0 runs as Administrator and performs an insecure log file...8.7 High
- jingdong jd cloud box ax6600, jdcloud ax6600 firmware +1 moreJingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges management5.3 Medium
- jingdong jd cloud box ax6600, jdcloud ax6600 firmware +1 moreJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi cast_streen privileges management5.3 Medium
- jingdong jd cloud box ax6600, jdcloud ax6600 firmware +1 moreJingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges management5.3 Medium
- jung enet smart home server, jung-group enet smart home +1 moreJUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup8.7 High
- ecwid by lightspeed ecommerce shopping cartEcwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access8.8 High
- dreamstechnologies truelysell coreTruelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration9.8 Critical
- katsushi-kawamori magic login mail or qr codeMagic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage8.1 High
- mend renovate-ce, renovate-ee-server, renovate-ee-worker +1 more +3 moreRenovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure6.8 Medium
- php frankenphpFrankenPHP leaks session data between requests in worker mode8.7 High
- apple macosThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia...6.0 Medium
- getoutline outlineOutline is vulnerable to privilege escalation vulnerability in document sharing7.6 High
- open-metadata openmetadataLeaky JWTs in OpenMetadata exposing highly-privileged bot users7.6 High
- cipplanner cipaceVulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17...8.8 High
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +27 more +29 moreWindows Remote Desktop Services Elevation of Privilege Vulnerability7.8 High
- craftcms cms, craft cms +1 moreCraft has a GraphQL Asset Mutation Privilege Escalation8.6 High
- jayarsiech jay login & registerJAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile8.8 High
- jayarsiech jay login & registerJAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user9.8 Critical
- blakeblackshear frigateFrigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape9.1 Critical
- quickheal total securityA vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component...7.8 High
- cyberark endpoint privilege managerCyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve...7.8 High
- unknown user profile builderUser Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset9.8 Critical
- progress software chef inspecUntrusted user data can lead to privilege escalation5.8 Medium
- eset, spol. s.r.o eset inspect connectorLocal privilege escalation in ESET Inspect Connector for Windows8.4 High
- futo immichimmich API Key Privilege Escalation vulnerability7.2 High
- unknown custom login page customizerCustom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset8.1 High
- broadcom symantec endpoint protection windows clientElevation of Privileges in Symantec Endpoint Protection Windows Client6.7 Medium
- broadcom symantec web security services agentElevation of Privileges in Web Security Services (WSS) Agent7.0 High
- kyvernoKyverno Cross-Namespace Privilege Escalation via Policy apiCall10.0 Critical
- dormakaba kaba exos 9300Local Privilege Escalation in dormakaba Kaba exos 9300 System management8.4 High
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter9.8 Critical
- No product listedAn issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows...8.8 High
- control-plane flux operator, controlplaneio-fluxcd flux-operator +1 moreFlux Operator Web UI Impersonation Bypass via Empty OIDC Claims5.3 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...7.5 High
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...4.6 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...6.0 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...7.5 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action9.8 Critical
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order9.8 Critical
- Show moreLoading…