Weakness (CWE)
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design, Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE-266
416 results · Clear filters · Feed
-
High 8.8
WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1.
-
High 7.4
kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.d…
-
High 7.3
zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization
A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/Us…
-
High 7.3
Tidelift moto AWS Batch Emulation models.py privileges management
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remo…
-
High 7.3
OpenBMB Internet of Agents Message app.py fetch_chat_record access control
A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id r…
-
High 8.1
Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved…
-
High 7.7
VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their o…
-
High 8.8
Babelfish for PostgreSQL Privilege Escalation
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, …
-
High 8.8
WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
-
High 8.8
WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
-
High 7.7
n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to a…
-
High 7.3
DeepSeek Harness Browser Auth browser-auth.ts improper authorization
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The atta…
-
High 7.3CVE-2026-116106 Public exploit
HeyCyan App FileProvider access control
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. T…
-
High 8.8
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers con…
-
High 8.8
WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
-
High 7.3
dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the c…
-
High 7.3
dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.p…
-
High 8.8
Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resourc…
-
High 7.3
light0011 cms Captcha Validation UserController.class.php access control
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. E…
-
High 8.1
WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
-
High 8.8
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:updat…
-
High 8.8
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
-
High 8.1
Gitea API token scope escalation through HTTP signatures
Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope infor…
-
High 7.3
SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper auth…
-
High 8.8
Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defi…
-
High 8.8
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Updat…
-
High 7.3
tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. …
-
High 8.2
WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
-
High 7.2
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
-
High 7.1
Privilege Escalation in Telerik Report Server Service-Agent Hub
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted ser…
-
High 8.8
WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
-
High 8.8
WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
-
High 7.2
WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
-
High 8.1
WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
-
High 8.1
WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.
-
High 7.2
WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
-
High 8.8
WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.
-
High 8.8
WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.
-
High 7.2
WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability
Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.
-
High 7.3
PickMall Lilishop Mobile Binding bindMobile improper authorization
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is …