CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- gitea runnerGitea Runner host isolation bypass through container options8.8 High
- nrwl nxNx daemon and plugin worker sockets are accessible to other local users8.5 High
- diviengine divi membershipDivi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter9.8 Critical
- tryghost ghostGhost: Editors Could Promote Staff Users to Their Own Role4.3 Medium
- tryghost ghostGhost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment5.3 Medium
- webrehab super forms – drag & drop form builderSuper Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login8.8 High
- johnson controls easy io fgEasyIO FG5.6 Medium
- wind river systems inc vxworks 7VxWorks 7 improper privilege management8.8 High
- apache http serverApache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function9.8 Critical
- wpclever wpc shop as a customer for woocommerceWPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint8.8 High
- bytecorestack – mcp connector for ai toolsByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool8.8 High
- webrehab super forms – drag & drop form builderSuper Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter9.8 Critical
- genians, inc genian ssl pns (frodo-core), genian ssl pns (watchcat-ui) +1 moreGenians, Inc Genian SSL PNS Improper Privilege Management7.5 High
- google androidIn multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass...7.8 High
- google androidIn kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a...4.4 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Local Privilege Escalation7.8 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Local Privilege Escalation7.8 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core OS Command Injection8.8 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Privilege Escalation through External Control of File Name or Path6.7 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core improper privilege management7.2 High
- pollen-robotics reachy-mini-osReachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant7.8 High
- zammadLocal privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package8.5 High
- unknown user frontendWP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption7.4 High
- zte u30 airAn information disclosure vulnerability in ZTE U30 Air product5.3 Medium
- google chromeImproper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92...8.6 High
- hewlett packard enterprise (hpe) instant onAuthenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Instant ON6.4 Medium
- hewlett packard enterprise (hpe) instant onAuthentication Bypass in the Captive Portal of HPE Networking Instant On6.5 Medium
- eclipse foundation threadxAttacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION`...8.5 High
- electronElectron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions8.3 High
- raspap raspap-webguiRaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management8.7 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Places component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Address Bar component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Service Workers component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DLL Services component8.8 High
- manageengine ddi centralAuthenticated File Write to RCE via keepalived in DDI Central8.8 High
- nezhahq nezhaNezha Dashboard before 2.3.5 Task Type Validation Bypass7.1 High
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings4.9 Medium
- itthinx groups – memberships and access controlGroups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode8.8 High
- budibase serverBudibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps8.6 High
- cap-go @capgo/cliCapgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account5.1 Medium
- cap-go capgo.appCap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation8.7 High
- cap-go capgo.appCapgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list7.1 High
- openclawOpenClaw Codex before 2026.7.1 Authorization Bypass via Bind8.7 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via chat.send7.2 High
- glpi-project glpiGLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)5.3 Medium
- krayin laravel-crmkrayin laravel-crm User Management UserController.php privileges management5.3 Medium
- zammadZammad: Incorrect Authorization and Improper Privilege Management8.7 High
- google gvisorHost Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE8.8 High
- knitpay knit pay – cashfree, instamojo, razorpay, paypal and moreKnit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field8.8 High
- ihomefinder optima express idxOptima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment7.3 High
- Show moreLoading…