Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
433 results · Clear filters · Feed
-
Critical 9.8
Authentication Bypass in the Web Management Interface of AOS-S
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
-
Critical 9.9
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulne…
-
Critical 9.8
Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `pass…
-
Critical 9.8
Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
Critical 9.8CVE-2026-15989 Public exploit
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submi…
-
Critical 9.4
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running a…
KEV Oct 2, 2026 -
Critical 9.8CVE-2026-14281 Public exploit
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly ac…
-
Critical 9.8
Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but le…
-
Critical 9.1
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
-
Critical 9.6
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
-
Critical 9.8CVE-2026-13355 Public exploit
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditiona…
-
Critical 9.9
pg_partman has privilege escalation through SQL injection in create_partition_time()
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELEC…
-
Critical 9.9
vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entri…
-
Critical 9.8CVE-2026-12793 Public exploit
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before …
-
Critical 9.1
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Critical 9.1
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Critical 9.6
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Critical 9.9
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The support…
-
Critical 9.9
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform S…
-
Critical 9.1
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versi…
-
Critical 9.1
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Event Java PX). The supported version …
-
Critical 9.1
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported v…
-
Critical 9.9
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to…
-
Critical 9.9
Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to…
-
Critical 9.0
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value direc…
-
Critical 9.8
Apache Syncope: Delegating users can grant unowned Roles
Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Sync…
-
Critical 9.8
WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated a…
-
Critical 9.9CVE-2026-84869 Exploited
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
KEV Sep 11, 2026 -
Critical 10.0
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could…
-
Critical 10.0
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due t…
-
Critical 9.1
Tenda CP3 Redirect.cpp SetRedirectEnable privileges management
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.
-
Critical 9.8
SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin bef…
-
Critical 9.1
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bi…
-
Critical 9.8
An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordControlle…
-
Critical 9.8
WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can …
-
Critical 9.8
Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registr…
-
Critical 9.8CVE-2026-9055 Public exploit
Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update e…
-
Critical 9.8
Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allo…
-
Critical 9.8
@hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
-
Critical 9.8
hulumi before v1.3.2 Privilege Escalation via IAM Policy
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can creat…