Weakness (CWE)
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design, Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE-266
1,328 results · Feed
-
High 7.9
Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceA…
-
Medium 4.3
Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege manag…
-
Medium 5.4
Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization
A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-dete…
-
Medium 6.3
OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privile…
-
Medium 6.3
SpaceX Starlink Router Gen 3 gRPC Management get_status access control
A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within t…
-
Low 3.1
D-Link DIR-842 vsftpd vsftpd.conf default permission
A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high co…
-
Low 3.1
TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission
A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degre…
-
Low 3.8
Webkul Bagisto Customer Item Deletion Endpoint access control
A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely…
-
High 8.8
Grav API Plugin before 1.0.13 Scope Bypass via createApiKey
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, a…
-
Critical 9.8
filebrowser through 2.63.16 Privilege Escalation via Signup
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, r…
-
High 8.8
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbit…
-
Medium 5.4
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
-
High 7.7
WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
-
Critical 9.8
WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.
-
High 8.1
WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
-
High 8.8
WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
-
High 8.1
WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.
-
Low 3.3
Incorrect Privilege Assignment in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom…
-
Critical 9.3
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (c…
-
Medium 5.3
Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain u…
-
High 8.8
Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation
A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including h…
-
High 7.6
Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, a…
-
High 8.1
Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execu…
-
High 7.8
Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management
A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. T…
-
High 7.3
Uasoft Badaso File API api.php class permission
A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack…
-
Medium 4.7
wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management
A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated…
-
Medium 4.7
nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control
A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be lau…
-
Medium 6.3
3CORESec Trapdoor DefaultFunction access control
A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this…
-
Medium 4.7
HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access co…
-
High 7.8CVE-2026-19195 Public exploit
V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control
A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed lo…
-
High 7.8CVE-2026-19193 Public exploit
Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control
A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. …
-
High 7.8
DeepCool DisplayService DeepCoolDisplayService.exe access control
A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must…
-
High 7.8
StableBit DrivePool DrivePoolService DrivePool.Service.exe permission
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permiss…
-
High 7.8
StableBit Scanner ScannerService Scanner.Service.exe permission
A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The att…
-
High 7.8
Power Sofware PowerISO Kernel Driver scdemu.sys privileges management
A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege ma…
-
Critical 9.8
WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
-
High 7.2
WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
-
Critical 9.8
WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
-
High 7.2
WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
-
High 8.8
WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability
Contributor Privilege Escalation in Forminator <= 1.56.0 versions.