Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
661 results · Clear filters · Feed
-
Medium 5.3
An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges…
-
Medium 4.3
Contao has improper privilege management for page and article fields
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in ver…
-
Medium 6.6
D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly…
-
Medium 5.3
Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662…
-
Medium 6.7
CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code ex…
-
Medium 4.3
In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout.
-
Medium 4.3
In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges bec…
-
Medium 5.6
Privilege Escalation in Symantec PGP Encryption 11.0.1
Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.
-
Medium 6.5
The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restriction…
-
Medium 5.9
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac…
-
Medium 6.3
In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-le…
-
Medium 6.5
Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)
A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcemen…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Medium 4.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Medium 5.4
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineerin…
-
Medium 6.8
Arbitrary file deletion vulnerability in ESET product installers
Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.
-
Medium 5.8
HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.
-
Medium 6.5CVE-2025-45737 Public exploit
An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileg…
-
Medium 6.5
CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to …
-
Medium 6.5
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS…
-
Medium 4.3
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ven…
-
Medium 6.5
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possib…
-
Medium 5.4
ZTE GoldenDB Database product has a privilege escalation vulnerability
There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content.
-
Medium 6.7
An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware ver…
-
Medium 6.0
Harden-Runner Evasion of 'disable-sudo' policy
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to `disable-sudo` bypass. Harden-Runner includes a policy option `disable-sudo` to prevent the GitHub Actions runne…
-
Medium 6.6
Rancher's External RoleTemplates can lead to privilege escalation
A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5.
-
Medium 4.3
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sono…
-
Medium 6.7
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application sea…
-
Medium 6.7
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
-
Medium 6.7
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
-
Medium 4.6
An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execut…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allo…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have all…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have a…
-
Medium 5.5
Accountsservice incorrectly drops privileges
accountsservice no longer drops permissions when writting .pam_environment
-
Medium 5.9
A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder
Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2…