Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,743 results · Clear filters · Feed
-
High 7.8
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.
-
High 8.5
WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution
A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting…
-
High 8.6
In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provide…
-
High 8.1
frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip …
-
High 7.2
Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate…
-
High 7.2
Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, i…
-
High 8.8
WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator acc…
-
High 7.3
Tidelift moto AWS Batch Emulation models.py privileges management
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remo…
-
High 7.1
CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.
-
High 7.1
Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion
Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bo…
-
High 8.1
WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter
The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP ar…
-
High 7.5
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in th…
-
High 8.8
Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress …
-
High 8.8
Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrato…
-
High 8.8
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability. Successful exploit…
-
High 7.1
FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checki…
-
High 8.8
Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form
The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This…
-
High 7.6
Pubjet | پابجت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action
The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no …
-
High 8.8
Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take ov…
-
High 8.8
SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow …
-
High 8.8
Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demot…
-
High 8.8
GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_r…
-
High 7.7
Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String
Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can cr…
-
High 8.8
Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-c…
-
High 7.2
Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, with…
-
High 8.3
Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker…
-
High 8.8
Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) Client
A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges o…
-
High 7.1
Privilege Escalation in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.
-
High 7.1
Local Privilege Escalation in HPE Networking Fabric Composer
A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.
-
High 7.5
Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer
A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's contro…
-
High 7.8
Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer
Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.
-
High 8.2
Local Privilege Escalation in HPE Networking Fabric Composer
A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.
-
High 7.2
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new l…
-
High 8.1
SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same …
-
High 8.5
User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer i…
-
High 7.8
CVE-2026-16305
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `exec…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to loca…
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing per…
-
High 7.8
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerabili…
-
High 8.8
Apache Syncope: AuthProfile value escalation via self-service update
Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.…