Weakness (CWE)
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design, Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE-266
686 results · Clear filters · Feed
-
Medium 4.3
ZKTeco BioTime System Settings API systemSettings access control
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access cont…
-
Medium 6.3
BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack c…
-
Medium 5.6
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
-
Medium 5.4
jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Perfor…
-
Medium 4.7
chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Managem…
-
Medium 6.6
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
-
Medium 6.3
David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote…
-
Medium 5.3
immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper a…
-
Medium 6.3
WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
-
Medium 4.7
gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The…
-
Medium 6.3
Eleveo Call Recording Software Query Builder searchAction.do access control
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is p…
-
Medium 6.5
Fleet applies namespace labels and annotations without the bundle's service account privileges
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the…
-
Medium 5.3
Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control
A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is poss…
-
Medium 6.3
Krayin laravel-crm acl.php access control
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The …
-
Medium 6.3
krayin laravel-crm User Management UserController.php privileges management
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_i…
-
Medium 5.3
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The mani…
-
Medium 5.3
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization
A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lea…
-
Medium 5.3
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization
A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argu…
-
Medium 5.4
kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulat…
-
Medium 6.6
Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames
A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the C…
-
Medium 6.6
CodeAstro QR Code Attendance Management System UserController.php save privileges management
A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument role_id results in improper privilege management. The attack ca…
-
Medium 6.3
samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privile…
-
Medium 5.3
Dromara UJCMS UserController UserController.java usernameExist improper authorization
A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation…
-
Medium 6.3
SveltyCMS User Attribute Update Endpoint +server.ts access control
A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the …
-
Medium 6.3
PHPGurukul Hostel Management System checklogin.php access control
A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The…
-
Medium 4.3
cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect pr…
-
Medium 6.3
cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization
A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Command Permission Ch…
-
Medium 5.3
Rizwan17 inventory-management-system dashboard.php access control
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access …
-
Medium 6.3
jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization
A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipu…
-
Medium 6.3
PHPGurukul Bank Locker Management System sidebar.php access control
A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. …
-
Medium 6.3
vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control
A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argu…
-
Medium 6.3
lenve vhr HrMapper.xml HrInfoController.updateHr privileges management
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be perf…
-
Medium 5.4
lenve vhr Password Update pass HrInfoController.updatePass improper authorization
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The at…
-
Medium 4.3
Xuxueli xxl-job JobGroupController.java privileges management
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privileg…
-
Medium 5.3
seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to imp…
-
Medium 6.1
Local Privilege Escalation via Misconfigured Sudoers Entry in Horizon Security Analyzer
Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by a…
-
Medium 6.5
WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a t…
-
Medium 4.7
elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper Script github-oidc-role.yaml privileges management
A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manip…
-
Medium 6.3
java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipul…
-
Medium 5.5
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant t…