CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53...8.8 High
- google chromeInappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker...5.1 Medium
- google chromeInappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a...6.1 Medium
- google chromeInappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a...8.8 High
- google chromeInappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53...7.8 High
- runzero platform, shopware +1 moreShopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts6.5 Medium
- mispMISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification9.0 Critical
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreBroadcast Receiver Privilege Escalation8.5 High
- themeum kirki – freeform page builder, website builder & customizerKirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'9.8 Critical
- google androidIn multiple functions of AppOpsService.java, there is a possible missing permission check due to...3.3 Low
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}8.1 High
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members9.6 Critical
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}6.5 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management5.3 Medium
- google androidIn multiple locations, there is a possible way to execute code in the launcher process due to an...7.8 High
- google androidIn multiple functions of PackageInstallerService.java, there is a possible way to install...7.8 High
- google androidIn onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data...6.8 Medium
- google androidIn createSessionInternal of PackageInstallerService.java, there is a possible to update a Device...6.2 Medium
- google androidIn handleBondStateChanged of AdapterService.java, there is a possible sensitive information...3.3 Low
- google androidIn hide of WindowState.java, there is a possible way to trick the user into approving permissions...6.8 Medium
- google androidIn InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a...6.2 Medium
- google androidIn updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to...3.3 Low
- google androidIn multiple locations, there is a possible tapjacking due to a logic error in the code. This...7.8 High
- otrsPossible information disclosure via External Interface5.7 Medium
- brainstormforce spectra gutenberg blocks – website builder for the block editorSpectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes8.8 High
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}9.6 Critical
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}8.1 High
- mervinpraison praisonai-platformPraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation9.4 Critical
- shopperdotcom shopperShopper: Authorization bypass and RBAC privilege escalation in team settings9.9 Critical
- dokployDokploy: Schedule Authorization Bypass Enables Host/Server Command Execution9.9 Critical
- rustfsRustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root9.3 Critical
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter9.8 Critical
- google chromeInappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a...8.8 High
- google chromeInappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote...9.6 Critical
- google chromeInappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed...8.3 High
- oracle e-business suite, flow manufacturing +1 moreVulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component:...8.8 High
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service...8.8 High
- oracle universal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...9.9 Critical
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...9.8 Critical
- casdoorCVE-2026-90949.8 Critical
- mennekes amtronPrivilege Escalation9.3 Critical
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection8.8 High
- acer nitrorsense v3NitroSense V3: Security Vulnerability Information8.5 High
- jenkins job import, jenkins project job import plugin +1 moreJenkins Job Import Plugin does not perform a permission check in an HTTP endpoint4.3 Medium
- jenkins appspider, jenkins project appspider plugin +1 moreJenkins AppSpider Plugin does not perform a permission check in a method implementing form validation4.3 Medium
- devsabbirahmed firebase support & chat managementFirebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- No product listedNorthern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.3.7 Low
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7,...7.8 High
- acer care centerAcer Care Center creates a Named Pipe with a weak Security Descriptor6.8 Medium
- acer nitrorsense v3NitroSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
- Show moreLoading…