Skip to content
OpenAdvisories

Weakness (CWE)

CWE-269: Improper Privilege Management

Class Draft Mapping discouraged

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it (3 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Follow the principle of least privilege when assigning access rights to entities in a software system.

  3. Architecture and Design

    Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Source: MITRE CWE-269

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-46817 Exploited Public exploit EPSS 12%

    Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi…

    Oracle Oracle Payments
    KEV Jul 15, 2026
  • Critical 9.8
    CVE-2021-20021 Exploited · Ransomware Public exploit Scanner template EPSS 89%

    A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

    SonicWall Email Security Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Tomcat

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

    Apache Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2017-5689 Exploited Public exploit Scanner template EPSS 92%

    An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Man…

    Intel Intel Active Mangement Technology, Intel Small Business Technology, Intel Standard Manageability
    KEV Jan 28, 2022