CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- alextselegidis plainpadPlainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)8.3 High
- syslifters sysreptorSysReptor: Privilege Escalation from User Admin to Superuser3.8 Low
- suitenumerique peoplePeople: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation5.5 Medium
- acer predatorsense, predatorsense v3, nitrosense +2 morePredatorSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
- getgrav gravGrav: Low-privileged API users can create super-admin accounts via blueprint-upload8.7 High
- google chromeInappropriate implementation in Chromoting in Google Chrome on Windows prior to 148.0.7778.96...7.8 High
- google chromeInappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote...6.3 Medium
- google chromeInappropriate implementation in ORB in Google Chrome prior to 148.0.7778.96 allowed a remote...6.3 Medium
- zte process guard serviceLocal privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client5.2 Medium
- jo-jo98 ciguardciguard: Container image runs as root (no USER directive)3.0 Low
- getgrav gravGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic8.1 High
- runzero platformrunZero Platform dashboard configuration exposure5.0 Medium
- dreamstechnologies mentoringMentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration9.8 Critical
- apache http serverApache HTTP Server: mod_rewrite elevation of privileges via ap_expr8.8 High
- containers bubblewrap, red hat enterprise linux 10, enterprise linux 8 +2 more +4 morebubblewrap vulnerable to privilege escalation in setuid mode via ptrace8.7 High
- carazo import and export users and customersImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields8.8 High
- linuxfoundation automotive grade linuxAGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation...7.8 High
- No product listedAn issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11...7.8 High
- ibm turbonomic prometurbo agentIBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability8.8 High
- tubitak bilgem software technologies research institute pardus software centerImproper Access Control in TUBITAK BILGEM's Pardus Software Center8.8 High
- entechtaiwan tvicportAn issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0...7.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability8.8 High
- jgrodgers highland software custom role managerHighland Software Custom Role Manager <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- No product listedThe Fan Control application V251 contains an improper privilege handling vulnerability in its...8.8 High
- ibm guardium key lifecycle managerMultiple Vulnerabilities in IBM Guardium Key Lifecycle Manager4.8 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by identity spoofing7.5 High
- freebsdMissing large page handling in pmap_pkru_update_range()6.2 Medium
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Debugger component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Networking component8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 morePrivilege escalation in the Graphics: WebRender component8.8 High
- honor aiassistantPrivilege Bypass in AiAssistant7.8 High
- honor pcmanagerPrivilege Bypass in PcManager3.2 Low
- m1k1o nekoNeko has Self-service Privilege Escalation for Authenticated Users8.8 High
- dell powerprotect data domain appliances, data domain operating system +1 moreDell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release...6.3 Medium
- doormanImproper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update...9.9 Critical
- No product listedIn OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly...8.8 High
- No product listedIn OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code...6.5 Medium
- minecanton209 novumosNovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)9.0 Critical
- minecanton209 novumosNovumOS has Privilege Escalation in the Syscall Interface9.4 Critical
- churchcrm crmChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function9.1 Critical
- openclawOpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events9.3 Critical
- openclawOpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade9.1 Critical
- zte red magic 11 pro (nx809j), nubia-in nx809j firmware +1 moreZTE Red Magic 11 Pro (NX809J) contains a vulnerability that allows non-privileged applications to trigger sensitive operations.5.0 Medium
- No product listedSTProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged...5.5 Medium
- dell storage managerDell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an...7.3 High
- ukrsolution barcode scanner (+mobile app) – inventory manager, order fulfillment system, pos (point of sale)Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication9.8 Critical
- weblateWeblate: Privilege escalation in the user API endpoint8.8 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Privilege Escalation via API User Role Modification8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreUniversal Plug and Play (upnp.dll) Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreConnected User Experiences and Telemetry Service Denial of Service Vulnerability5.5 Medium
- Show moreLoading…