CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php8.8 High
- boonebgorges buddypress groupblogBuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR8.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)7.1 High
- go-vikunja vikunjaVikunja Affected by Privilege Escalation via Project Reparenting8.3 High
- openclawOpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication6.0 Medium
- openclawOpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope8.7 High
- aiven aiven-operator, operator +1 moreAiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource6.8 Medium
- No product listedThe pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate...7.8 High
- openclawOpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint5.3 Medium
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence7.1 High
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config7.1 High
- filebrowserFile Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands8.1 High
- runzero platformrunZero Platform superuser privilege escalation8.1 High
- pi-holePi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).6.4 Medium
- kernel util-linuxutil-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup4.7 Medium
- ci4-cms-erp ci4msCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.4 Critical
- openclawOpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes9.1 Critical
- openclawOpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy2.0 Low
- openclawOpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes8.8 High
- belden hirschmann industrial hivisionBelden Industrial HiVision Arbitrary Code Execution via Malicious Project File8.5 High
- belden hirschmann hisecos eagleBelden HiSecOS Web Server Privilege Escalation8.7 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...8.2 High
- himmelblau-idm himmelblauhimmelblau: NSS fake-primary group lookup reintroduces name collision risk6.3 Medium
- filebrowserFile Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution8.1 High
- discourseDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions6.3 Medium
- craigjbass clearancekitClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modification6.3 Medium
- openclawOpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence7.1 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim8.7 High
- ellanetworks core, ella core +1 moreElla Core has Privilege Escalation via Database Restore by NetworkManager role7.2 High
- openclawOpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation8.7 High
- ameliabooking booking for appointments and events calendar – ameliaAmelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change8.8 High
- containers crunCrun incorrectly parses `crun exec` option `-u`, leading to privilege escalation0.0 None
- enter software iperius backupEnter Software Iperius Backup Backup Job Configuration File privileges management7.3 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...4.0 Medium
- apple xcodeA permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4...6.2 Medium
- osslsigncode project osslsigncodeAn issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to...9.8 Critical
- ralphje signifySignify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components8.8 High
- go-vikunja vikunjaVikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration6.5 Medium
- systemdsystemd: Local unprivileged user can trigger an assert5.5 Medium
- wpextended the ultimate wordpress toolkit – wp extendedThe Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module8.8 High
- carazo import and export users and customersImport and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields8.1 High
- appcheap app builder – create native android & ios apps on the flightApp Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter6.5 Medium
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration7.5 High
- bluewave-labs checkmateMass Assignment Privilege Escalation in Checkmate8.1 High
- discourseDiscourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint2.2 Low
- openwrtOpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation1.8 Low
- wazuhWazuh has Privilege Escalation to Root via Cluster Protocol File Write9.1 Critical
- filebrowserFile Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin10.0 Critical
- openclawOpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing9.3 Critical
- openclawOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections9.4 Critical
- Show moreLoading…