CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server forest operations9.9 Critical
- yungengxin yun jia security guardYungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management4.8 Medium
- yangzongzhuan ruoyiyangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management5.3 Medium
- samsung mobile devicesImproper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local...6.7 Medium
- unknown crowdfundlyCrowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation7.2 High
- unknown ai content generator marketingAI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion9.8 Critical
- unknown envira galleryEnvira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard7.2 High
- mobile builder builder, unknown mobile builder +1 moreMobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin8.8 High
- zte z80 ultraUnauthorized access vulnerability in ZTE Z80 Ultra product5.5 Medium
- zte z80 ultraInformation disclosure vulnerability in ZTE Z80 Ultra product3.3 Low
- zte z80 ultraUnauthorized information retrieval vulnerability in ZTE Z80 Ultra product5.5 Medium
- zte z80 ultraInformation disclosure vulnerability in ZTE Z80 Ultra product3.3 Low
- unknown sms alertSMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset8.1 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion8.1 High
- foosales – point of sale (pos) for woocommerceFooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint8.8 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter8.8 High
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter8.8 High
- zte z80 ultraUnauthorized access vulnerability in ZTE Z80 Ultra product5.7 Medium
- creativethemeshq blocksy companionBlocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter9.1 Critical
- kodezen academy lms – ai course builder, quizzes, certificates & elearningAcademy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint5.4 Medium
- go-vikunja vikunjaVikunja 2.6.0 Broken Access Control via Inherited Project Permissions5.3 Medium
- go-vikunja vikunjaVikunja: Scoped API token can mint unrestricted OAuth session credentials8.1 High
- davidanderson redux frameworkRedux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension6.8 Medium
- unknown foosalesFooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation8.8 High
- ibm guardium data protectionIBM Guardium Data Protection Privilege Escalation7.8 High
- zimbra collaboration suiteZimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right7.1 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +9 more +11 moreInsights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader7.7 High
- infoblox niosAuthenticated argument injection in NIOS command line leading to privilege escalation9.1 Critical
- m a vinoth kumar frontend dashboardFrontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call9.8 Critical
- brocade fabric os, broadcom fabric operating system +1 moreBrocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA ...7.5 High
- brocade fabric os, broadcom fabric operating system +1 moreAn Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation...7.1 High
- splunk, splunk enterprise +1 moreLocal Privilege Escalation through Linux Package Upgrades in Splunk Enterprise7.7 High
- wger-project wgerwger: Trainer Privilege Escalation - Improper Privilege Management7.1 High
- unknown koinonia linkKoinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator8.8 High
- @backstage backend-defaults, backstage, linuxfoundation backstage\/backend-defaults +2 moreBackstage: Improper preservation of access restrictions during service credential delegation7.6 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Local Privilege Escalation in ClearPass Client Software6.7 Medium
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agent7.8 High
- hewlett packard enterprise (hpe) aos-switch (aos-s)Authenticated Privilege Escalation Vulnerability in the API of AOS-S8.8 High
- hewlett packard enterprise (hpe) aos-switch (aos-s)Authentication Bypass in the Web Management Interface of AOS-S9.8 Critical
- google chromeImproper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a...5.4 Medium
- dell container storage modules (csm), container storage modules +1 moreDell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper...9.9 Critical
- penpotPenpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)6.7 Medium
- penpotPenpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection4.9 Medium
- google androidIn updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass...7.8 High
- google androidIn shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a...7.8 High
- google androidIn multiple locations, there is a possible permission bypass due to a logic error in the code....7.8 High
- makeplane planePlane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles8.1 High
- makeplane planePlane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)5.4 Medium
- laradashboardLaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering8.6 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /e…8.8 High
- Show moreLoading…