CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- dotcmsImproper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS...9.4 Critical
- apache syncopeApache Syncope: User self-service privilege escalation9.8 Critical
- unknown social login, passkeys, magic link & email otpPasswordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force8.1 High
- linux, linux kernel +1 morenet: skmsg: preserve sg.copy across SG transforms9.4 Critical
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Privilege Escalation Vulnerability7.1 High
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Local Privilege Escalation Vulnerability7.8 High
- broadcom symantec management suiteLocal privilege escalation in Symantec ITMS5.1 Medium
- broadcom symantec it management suiteArbitrary File Read as SYSTEM in Symantec ITMS5.1 Medium
- quadlayers ai copilotAI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth9.8 Critical
- unknown user registration & membershipUser Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID8.1 High
- coderevolution aimogen pro - all-in-one ai content writer, editor, chatbot & automation toolkitAimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'9.8 Critical
- bricksforgeBricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter9.8 Critical
- arcadedata arcadedb, com.arcadedb arcadedb-server +1 moreArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read7.7 High
- getwpfunnels wpfunnels – funnel builder for woocommerce with checkout & one click upsellWPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter8.8 High
- unitedover digits: wordpress mobile number signup and loginDigits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter8.8 High
- eset, spol. s.r.o eset inspect connectorLocal privilege escalation via unauthenticated ALPC in ESET Inspect Connector8.5 High
- davidanderson redux frameworkRedux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator8.8 High
- No product listedAn issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler...6.5 Medium
- wekanWekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin7.6 High
- taosdata tdengineTDengine: Standard User permission unexpect5.4 Medium
- @better-auth sso, better-auth, better-auth better auth +1 more +3 moreBetter Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso7.1 High
- pegatron corp. tdelo64.sysCVE-2026-149616.2 Medium
- pegatron corp. tdelo64.sysCVE-2026-149609.8 Critical
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint8.7 High
- dell powerscale onefsDell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2...6.7 Medium
- woodpecker-ci woodpeckerWoodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend9.0 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Group Policy Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreMicrosoft Install Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Zero Trust DNS Security Feature Bypass Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreWindows WalletService Elevation of Privilege Vulnerability7.8 High
- citrix endpoint analysis client for windows, secure access client for windows +1 moreLocal Privilege escalation allows a low-privileged user to gain SYSTEM privileges8.5 High
- go-shiori shioriShiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account8.7 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)8.1 High
- No product listedAn issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via...9.8 Critical
- openwrt luciOpenWrt luci-app-samba4 read ACL remote code execution via smbd8.7 High
- nicu m simple jwt login – allows you to use jwt on rest endpoints.Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter8.8 High
- wp grid builder grid builderWP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter8.8 High
- grokability snipe-itSnipe-IT: Improper Privilege Management7.0 High
- apache software foundation iotdbApache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor6.5 Medium
- No product listedAn issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the ...9.1 Critical
- discourseDiscourse: Signup-time primary_group_id assignment grants whisperer access8.2 High
- palo alto networks prisma browserPrisma Browser: Local Privilege Escalation on macOS2.0 Low
- palo alto networks cortex xdr broker vmCortex XDR Broker VM: Privilege Escalation (PE) Vulnerability1.1 Low
- blakeblackshear frigateFrigate viewer can read logs exposing admin and camera credentials8.1 High
- themehunk th login registrationThemehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter6.3 Medium
- shen2 多说社会化评论框多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters8.8 High
- pixelgrade backstage – customizer demo accessBackstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities7.5 High
- fluxink color management driverFluxInk Color Management Driver local privilege escalation8.4 High
- fossbillingFOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation8.5 High
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management6.9 Medium
- Show moreLoading…