Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
1,758 results · Clear filters · Feed
-
High 8.1
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that …
-
High 7.2
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account emai…
-
High 7.1
Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface
An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions o…
-
High 7.2
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privi…
-
High 8.8
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submi…
-
High 7.2
Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. …
-
High 7.8
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…
-
High 8.1
WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauth…
-
High 7.5
Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged …
-
High 8.1
Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers…
-
High 8.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Sup…
-
High 7.8
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: …
-
High 8.8
Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected are 19.3-19.…
-
High 7.0
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundat…
-
High 7.8
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentati…
-
High 7.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affec…
-
High 8.8
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…
-
High 7.8
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported ve…
-
High 7.8
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported ver…
-
High 8.4
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Cont…
-
High 8.4
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affecte…
-
High 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su…
-
High 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su…
-
High 7.2
Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported …
-
High 7.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
High 7.8
Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported version that is affected is 13…
-
High 7.0
Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported version that is affected is 13…
-
High 7.0
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 7.0
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). S…
-
High 7.2
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). S…
-
High 7.8
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterpris…
-
High 7.2
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). S…
-
High 7.8
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affec…
-
High 7.8
Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affec…
-
High 7.5
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues)…
-
High 7.2
Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). S…
-
High 7.8
Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay). Supported versions that…
-
High 8.8
Improper privilege management in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveragi…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may b…
-
High 8.4
IBM Sterling Connect:Direct for Unix Improper Privilege Management
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.