CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- altium aes, asustor inc. abp +1 moreAn improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.8.5 High
- razer rzupdateserviceRazer RzUpdateService Named Pipe RzUpdateService.exe privileges management8.5 High
- wellbia xigncode3CVE-2026-154306.2 Medium
- carazo import and export users and customersImport and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import9.1 Critical
- arcadedata arcadedbArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger8.7 High
- unknown pouco import usersPouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation9.8 Critical
- pronamic payPronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field8.8 High
- unknown user profile builderProfile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration8.1 High
- wp swings subscriptions for woocommerceSubscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta8.8 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field8.1 High
- unknown demiDemi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory7.5 High
- projectcapsule capsuleCapsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)6.6 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a cross-site request forgery8.3 High
- metagauss profilegridProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID7.5 High
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a...8.8 High
- google chromeInappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a...8.8 High
- google chromeInappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker...7.5 High
- google chromeInappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72...8.8 High
- google chromeInappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72...8.4 High
- google chromeInsufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote...8.8 High
- google chromeInappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a...7.8 High
- google chromeInappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72...7.8 High
- google chromeInsufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72...7.5 High
- google chromeInappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote...8.8 High
- google chromeInappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72...7.1 High
- saadiqbal wholesale for woocommerceWholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter8.8 High
- teydeastudio wp password policyWP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCriu: criu: container escape via rseq critical section hijack during checkpoint/restore7.8 High
- eazyplugins eazy plugin manager – powerful plugin management solution for wordpressEazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint8.8 High
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset9.8 Critical
- jfrog artifactoryJFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.7.2 High
- thorsten phpmyfaqphpMyFAQ before 4.1.6 Privilege Escalation via Group Membership8.5 High
- silverplugins217 custom fields account registration for woocommerceCustom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation8.1 High
- unknown memberglutMemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- budibaseBudibase: Privilege escalation via public role assignment API missing app-level authorization8.8 High
- loytec l-dali, l-gate, l-inx +5 more +7 moreLoytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo8.4 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreAccountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users5.5 Medium
- eset spol. s.r.o. cyber security for macos, endpoint security for macos, eset, spol. s r.o. eset endpoint security for macos +2 moreLocal privilege escalation in ESET security applications for macOS8.5 High
- eset spol. s.r.o. cyber security for macos, endpoint security for macos, eset, spol. s r.o. eset endpoint security for macos +2 moreLocal privilege escalation in ESET security applications for macOS8.5 High
- unknown cafehaus apiCAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset7.5 High
- unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict contentProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection7.5 High
- wpify woo – withdrawal, crn/vat, qr payments, heureka and more for woocommerceWPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint8.0 High
- owap defectdojoOWASP DefectDojo API/Web serializers.py UserSerializer privileges management5.3 Medium
- johnson controls victor webvictor Web - Priviledge Escalation7.1 High
- casdoorCVE-2026-156309.9 Critical
- getgrav gravGrav API Plugin 1.0.9 Privilege Escalation via Invitations groups8.7 High
- mdjm event managementMDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers8.8 High
- No product listedAn issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate...7.8 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...8.8 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...8.8 High
- Show moreLoading…