Skip to content
OpenAdvisories

Weakness (CWE)

CWE-269: Improper Privilege Management

Class Draft Mapping discouraged

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it (3 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Follow the principle of least privilege when assigning access rights to entities in a software system.

  3. Architecture and Design

    Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Source: MITRE CWE-269

All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-116471 Public exploit

    BKWLD Decoy Authorization Policy Policy.php privileges management

    A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The atta…

    BKWLD Decoy
  • Medium 5.4
    CVE-2026-86552 Public exploit

    A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

    SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via …

    ZTE SmartLife
  • Medium 6.2
    CVE-2026-15430 Public exploit

    CVE-2026-15430

    Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected l…

    Wellbia XIGNCODE3
  • Medium 6.3
    CVE-2026-16764 Public exploit

    OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

    A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The a…

    OWASP DefectDojo
  • Medium 6.5
    CVE-2026-36425 Public exploit

    An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local use…

  • Medium 6.8
    CVE-2026-9490 Public exploit

    Acer Care Center creates a Named Pipe with a weak Security Descriptor

    A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type…

    Acer Care Center
  • Medium 5.5
    CVE-2025-70795 Public exploit

    STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOC…

  • Medium 6.9
    CVE-2025-67727 Public exploit

    Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

    Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access …

    parse-community parse-server
  • Medium 6.5
    CVE-2025-45737 Public exploit

    An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileg…

  • Medium 6.1
    CVE-2025-0651 Public exploit

    File symlink abuse might lead to deleting files belonging to SYSTEM user

    Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all…

    Cloudflare WARP
  • Medium 5.1
    CVE-2024-8068 Exploited Public exploit

    Privilege escalation to NetworkService Account access

    Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

    Citrix Citrix Session Recording Network devices
    KEV Aug 25, 2025
  • Medium 6.8
    CVE-2024-37726 Public exploit

    Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker t…

  • Medium 6.8
    CVE-2024-5909 Public exploit

    Cortex XDR Agent: Local Windows User Can Disable the Agent

    A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform mal…

    Palo Alto Networks Cortex XDR Agent Network devices
  • Medium 5.5
    CVE-2024-22513 Public exploit

    Improper Privilege Management in djangorestframework-simplejwt

    djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

    python-djangorestframework-simplejwt djangorestframework-simplejwt python-djangorestframework-simplejwt Debian Ubuntu PyPI
  • Medium 4.5
    CVE-2024-2432 Public exploit

    GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

    A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race …

    Palo Alto Networks GlobalProtect App Network devices
  • Medium 6.5
    CVE-2020-36603 Public exploit

    The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unpr…

  • Medium 6.5
    CVE-2022-20361 Public exploit

    In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weak…

    Android
  • Medium 6.2
    CVE-2022-20360 Public exploit

    In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local esca…

    Android
  • Medium 6.3
    CVE-2019-25066 Public exploit

    ajenti API privileges management

    A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to t…

  • Medium 6.3
    CVE-2021-29449 Public exploit

    Multiple Privilege Escalation Vulnerabilities Pihole

    Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.

    pi-hole pi-hole
  • Medium 4.4
    CVE-2021-25337 Exploited Public exploit

    Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…

    Samsung Mobile Samsung Mobile Devices
    KEV Nov 8, 2022
  • Medium 6.1
    CVE-2020-15368 Public exploit

    AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering…