CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- ibm iIBM i is Affected By Multiple Vulnerabilities in DRDA / DDM3.1 Low
- ibm iIBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []8.8 High
- elastic kibanaImproper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys6.5 Medium
- ibm iIBM i is Affected By An Improper Management Vulnerability in HTTP Server []7.8 High
- gitea open source git serverGitea runner registration-token GET endpoint performs a write under a read-only token scope6.5 Medium
- iqonic design kivicareKiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration7.5 High
- seriousm4x upsnapUpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd9.8 Critical
- ibm iIBM i is Affected By Multiple Vulnerabilities in the Debug Server8.8 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa9.9 Critical
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i9.6 Critical
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i8.8 High
- ibm iIBM i is Affected By improper privilege management in Navigator for i8.1 High
- semaphoreui semaphoreSemaphore UI: Manager-to-owner privilege escalation via custom-role slug collision8.8 High
- jfrog artifactoryProject Resource Managers may escalate privileges in JFrog Artifactory7.2 High
- rustfsRustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts8.8 High
- pixelite events managerEvents Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces7.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings5.3 Medium
- acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressAcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update8.8 High
- cursorCursor: Sandbox escape via launching privileged containers7.7 High
- microsoft app installerWindows Package Manager Elevation of Privilege Vulnerability7.3 High
- intel proset\/wireless wifiImproper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within...7.1 High
- authentik security authentikAuthentik Security authentik - Privilege Escalation8.8 High
- authentik security authentikAuthentik Security authentik - Privilege Escalation8.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation8.8 High
- dokployDokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)9.9 Critical
- dokployDokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host9.9 Critical
- apache rangerApache Ranger: Privilege Escalation via URL Parameter9.8 Critical
- appsbd viteposVitepos < 3.6.0 - Outlet Manager+ Privilege Escalation7.2 High
- unknown foodboxbookerFoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset9.8 Critical
- kingston fury ctrl rgb control softwareKingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management8.5 High
- systemd systemd-homedsystemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path6.7 Medium
- wongcyrus excellexbotwongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management5.1 Medium
- wupsales ai copilot – content generatorAI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route9.8 Critical
- pleskImproper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated...9.9 Critical
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation8.8 High
- power sofware powerisoPower Sofware PowerISO Kernel Driver scdemu.sys privileges management8.5 High
- open-reception appointment-booking-softwareOpenReception: Tenant admin self-promotes to GLOBAL_ADMIN9.9 Critical
- wso2 api control plane, api manager, traffic manager +3 more +5 morePrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover9.8 Critical
- mf-yang openclaw-cnmf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management5.3 Medium
- nanocoai nanoclawnanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management5.3 Medium
- jenkins project horreum pluginJenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate...4.3 Medium
- cisco ios xe softwareCisco IOS XE Software Web-Based Management Interface Vulnerability4.3 Medium
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server Hadoop integration9.9 Critical
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server REST document patch operation9.9 Critical
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server REST query interfaces9.9 Critical
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server REST API document processing8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +5 more +7 moreKeycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary5.4 Medium
- supsysticcom smart popup by supsysticSmart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator8.8 High
- samsung open source oneA vulnerability allowing local privilege escalation to the Reporter service context.8.4 High
- Show moreLoading…