CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- akbilisim ak frameworkAk Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update8.8 High
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision7.4 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management...7.8 High
- cloud foundry cf-deployment, controller (capi) +1 moreCredential exposure to space supporter6.5 Medium
- unknown logixfast authLogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset9.8 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...7.2 High
- rankingcoach beyondseo – ai seo to improve rankings, listings & online visibilityBeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation6.3 Medium
- magepeopleteam event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendarEvent Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter7.2 High
- unknown gosmtpGoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings7.2 High
- jhuckaby cronicleCronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-394018.8 High
- devolutions serverApp passwords were allowed to bypass password confirmation on sensitive endpoints.5.3 Medium
- teamviewer remote - patch managementLocal Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows7.3 High
- nagios host, teamviewer full client +1 moreLocal Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows7.3 High
- teamviewer remote management - monitoringLocal Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows7.3 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Navigation component8.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Toolkit component9.8 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release...6.3 Medium
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release...6.7 Medium
- octopus deploy serverIn affected versions of Octopus Server, a user holding the System Manager role could escalate...8.6 High
- smci mbd-x12spiSupermicro BMC IPMI feature contains a Privilege escalation vulnerability8.8 High
- esaqa gmbh psonoDevice-code claim permits restricted token escalation in Psono Server6.5 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation5.3 Medium
- apple macosThis issue was addressed with improved access restrictions. This issue is fixed in macOS Golden...8.8 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.8 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.8 High
- bkwld decoyBKWLD Decoy Authorization Policy Policy.php privileges management5.3 Medium
- icret easyimageicret EasyImage del.php privileges management6.9 Medium
- No product listedAn issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0...7.8 High
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login2.1 Low
- unknown duplicatorDuplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade7.2 High
- unknown datawiza proxy auth pluginDatawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers9.8 Critical
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderaBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute8.8 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute7.1 High
- hallo welt! gmbh bluespicebluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop9.3 Critical
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action8.1 High
- unknown user profile builderProfile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change7.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes6.5 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface7.1 High
- berriai litellmLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key9.9 Critical
- unknown hipaa formsCM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role7.2 High
- getgrav grav-plugin-loginGrav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite8.7 High
- red hat multicluster global hubMulticluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide7.2 High
- cisco cyber vision, open source snort3, secure firewall threat defense (ftd) software +1 more +3 moreMultiple Cisco Products Snort 3 Software Hardening Release: October 20267.8 High
- unknown wp user manager, wp user manager user manager +1 moreWP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect8.1 High
- unknown simple bannerSimple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting7.5 High
- triggerdotdev trigger.devTrigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint8.6 High
- oracle data integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component:...8.8 High
- oracle essbaseVulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is...6.0 Medium
- oracle communications billing and revenue managementVulnerability in the Oracle Communications Billing and Revenue Management product of Oracle...7.8 High
- oracle corporation olapVulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that...8.8 High
- Show moreLoading…