CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn multiple functions of SmsController.java, there is a possible escalation of privilege due to a...7.8 High
- google androidIn kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission...7.8 High
- google androidIn Bootloader, there is a possible permission bypass due to a missing permission check. This...6.7 Medium
- mcphubMCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration8.8 High
- ieungsoft ultra ramdisk proieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management9.3 Critical
- iobit unlockerIObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management4.6 Medium
- iobit uninstallerIObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management4.8 Medium
- kerberosmansour hulumihulumi before v1.3.2 Privilege Escalation via IAM Policy9.3 Critical
- colorful igamecenterColorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management9.3 Critical
- unknown really simple securityReally Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin6.6 Medium
- addify custom user registration fields for woocommerceCustom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout9.8 Critical
- unknown uix usercenterUix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation9.8 Critical
- unknown memberheroSimple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- piccolo-orm piccolo adminPiccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.8.8 High
- unknown user registration & membershipUser Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings7.2 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms8.1 High
- adobe dimensionWatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs9.3 Critical
- flowintelFlowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges8.6 High
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings7.2 High
- No product listedArbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno...9.8 Critical
- No product listedAn issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote...7.2 High
- kitae-park mang board wpMang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie8.8 High
- unknown forminator formsForminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation3.7 Low
- google chromeImproper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote...9.8 Critical
- google chromeImproper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a...4.3 Medium
- google chromeImproper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65...8.8 High
- google chromeImproper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a...8.3 High
- apple ios and ipados, iphone os +1 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5...3.3 Low
- roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solution with ecommerce templates & woo widgetsShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes7.2 High
- octopus codefreshIn affected versions of the Codefresh platform an authenticated user can utilize an API endpoint...8.6 High
- alex content maskContent Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask2.7 Low
- unknown restrictmateRestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- marc4 security hardenerSecurity Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite8.8 High
- unknown forminator formsForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass6.6 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action8.8 High
- perber leafwikiLeafWiki Vulnerable to Privilege Escalation via User Self-Service Update8.8 High
- apache cloudstackApache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow8.8 High
- jordy meow ai engineAI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools7.2 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.8 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.8 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.8 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.8 High
- tektoncd pipelines-as-codePipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution6.5 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.0 High
- unknown json optionsJSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update9.8 Critical
- splunk ai toolkitImproper Access Control through Scheduled Searches in Splunk AI Toolkit7.5 High
- splunk, splunk enterprise +1 moreImproper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise8.8 High
- splunk, splunk enterprise +1 moreImproper Privilege Management on the Management Port in Splunk Enterprise for Windows8.8 High
- splunk, splunk enterprise +1 morePrivilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise8.8 High
- Show moreLoading…