CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...8.8 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...8.8 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...8.8 High
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.8 Critical
- oracle virtual directoryVulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component:...8.8 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps5.8 Medium
- red hat multicluster engine for kubernetes, advanced cluster management for kubernetes 2 +1 moreManaged-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval8.7 High
- hmbown codewhaleCodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact7.3 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Enterprise Policies component9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Request Handling component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Application Update component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Downloads API component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Shell Integration component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Networking: Cookies component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Remote Settings Client component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Graphics: CanvasWebGL component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Navigation component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Networking component8.8 High
- arcadedata arcadedbArcadeDB before 26.8.1 Authentication Bypass via Async Command9.4 Critical
- arcadedata arcadedbArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting5.3 Medium
- arcadedata arcadedbArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction9.4 Critical
- getgrav gravGrav before 2.0.14 Privilege Escalation via Group Access Field9.3 Critical
- dokployDokploy: Invitation Role Escalation Allows Organization Takeover8.0 High
- skypilot-org skypilotSkyPilot Authentication Bypass via Service Account Role Escalation8.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSearch-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters8.8 High
- webkul bagistoWebkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management5.3 Medium
- No product listedAn issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company...9.8 Critical
- No product listedAn issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate...9.8 Critical
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import7.2 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter9.8 Critical
- No product listedOpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management5.3 Medium
- webcodingplace real estate manager proReal Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision7.5 High
- cedcommerce wholesale marketWholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter8.8 High
- connectordev bloyal: loyalty & promotions by bloyalbLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings8.8 High
- fassionstorage propovoice: all-in-one client management systemPropovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter8.8 High
- microsoft malware protection engineMicrosoft Defender Elevation of Privilege Vulnerability7.8 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default...7.8 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization...6.3 Medium
- akauntingCVE-2026-167728.1 High
- getgrav grav-plugin-apiGrav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys8.7 High
- getgrav gravGrav API Plugin before 1.0.13 RCE via ConfigController scope bypass8.7 High
- getgrav gravGrav before 1.0.13 API Key Scope Bypass via UsersController8.7 High
- getgrav gravGrav before 1.0.13 API Key Scope Bypass via InvitationsController8.6 High
- unknown essential addons for elementorEssential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment8.1 High
- openchoreoOpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation9.0 Critical
- freepbx backupFreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module8.6 High
- ibm iIBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime8.4 High
- ibm iIBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime8.9 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty8.8 High
- ibm iIBM i is Affected By An Improper Privilege Management Vulnerability in LDAP []4.4 Medium
- Show moreLoading…