CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- thorsten phpmyfaqphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API7.0 High
- thorsten phpmyfaqphpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights7.0 High
- getarcaneapp arcaneArcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)8.8 High
- ibm iIBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH5.4 Medium
- ibm iIBM i is Affected By An Improper Privilege Management Vulnerability7.8 High
- canove whaticket-communityWhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup9.3 Critical
- mailuMailu domain managers can take over higher-privileged accounts7.2 High
- aresit wp compress – instant performance & speed optimizationWP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint4.8 Medium
- ontraport pilotpressPilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter8.8 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]8.1 High
- jeff farthing theme my loginTheme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter9.8 Critical
- joedolson my calendar – accessible event managerMy Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute9.8 Critical
- posimyththemes nexter extension – security, performance, code snippets & site toolkitNexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter7.5 High
- properfraction mailoptin – popup, optin forms & email newsletters for mailchimp, hubspot, aweber etc.MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter9.8 Critical
- instawp connect – 1-click wp staging & migrationInstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting7.5 High
- wpcodefactory customer email verification for woocommerceCustomer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter8.1 High
- eclipse foundation connected services platformIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver...7.5 High
- wpxpo wholesalex – all-in-one b2b solution with wholesale pricingWholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'5.4 Medium
- prism it systems user rights access managerUser Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler9.8 Critical
- kedacore kedaKEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication9.9 Critical
- report one myreport updaterMyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service8.5 High
- wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notificationsSimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register9.8 Critical
- davefx membership & user roles for woocommerce (automatic role changer)Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache7.5 High
- bitpressadmin bit integrations – form integration, webhook, spreadsheets, crm, lms & email automationBit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data7.5 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.8 High
- leantimeLeantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the WebExtensions component8.8 High
- calcom cal.com, cal.diy +1 morecalcom cal.com/cal.diy Credentials delete credentials.delete privileges management5.3 Medium
- logius digid for macosThe macOS version of the DigiD app is not signed with Hardened Runtime7.1 High
- No product listedAn issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed...9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the WebExtensions component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Navigation component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Panning and Zooming component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Application Update component8.8 High
- ibm iIBM i is Affected By An Improper Privilege Management Vulnerability4.4 Medium
- frappe erpnextFrappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation8.7 High
- elated-themes frappeFrappe before 15.41.0 Privilege Escalation via Document Action8.7 High
- ibm maximo application suite - location service for esri componentIBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management7.2 High
- zofe rapyd-adminRapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component8.6 High
- containerdcontainerd CRI plugin: Checkpoint restore bypasses destination security context7.8 High
- ibm db2IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management8.8 High
- ibm db2IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance8.8 High
- ibm db2IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility6.5 Medium
- getgrav grav-plugin-apiGrav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants8.6 High
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server backup and restore operations9.6 Critical
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server xdmp:eval-in9.9 Critical
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server higher-order XQuery functions8.6 High
- progress software corporation marklogic serverPath traversal and privilege management flaws in Progress MarkLogic Server InfoStudio8.5 High
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server REST extensions8.4 High
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server Management API9.9 Critical
- Show moreLoading…