Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,015 results · Feed
-
Critical 9.8
All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own b…
-
High 8.8
GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_r…
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy
Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks…
-
High 7.7
Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String
Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can cr…
-
Critical 9.8
Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespa…
-
Medium 6.3
yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms ca…
-
High 8.8
Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-c…
-
High 7.2
Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, with…
-
Medium 6.3
EasySoft ZenTao PMS User model.php checkGroupChange privileges management
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege managemen…
-
High 8.3
Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker…
-
High 8.8
Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) Client
A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges o…
-
Medium 5.3
Privilege Escalation Leading to Information Disclosure in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitiv…
-
Medium 6.4
Privilege Escalation Vulnerability in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privileges to gain elevated pri…
-
High 7.1
Privilege Escalation in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.
-
High 7.1
Local Privilege Escalation in HPE Networking Fabric Composer
A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.
-
High 7.5
Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer
A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's contro…
-
High 7.8
Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer
Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.
-
High 8.2
Local Privilege Escalation in HPE Networking Fabric Composer
A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.
-
High 7.2
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new l…
-
High 8.1
SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same …
-
High 8.5
User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer i…
-
High 7.8
CVE-2026-16305
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `exec…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to loca…
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing per…
-
High 7.8
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerabili…
-
High 8.8
Apache Syncope: AuthProfile value escalation via self-service update
Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.…
-
Critical 9.9
Prefab UI Pyodide sandbox escape to host RCE
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the l…
-
Critical 9.9
Beta9 build sandbox escape via chroot-only isolation
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its…
-
Medium 4.7
ken678 YznCMS Auth Group Group.php Backend privileges management
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege managem…
-
High 8.8
User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` …
-
High 8.8
Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/book…
-
High 7.5
Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above…
-
Medium 4.2
Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_role
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly regist…
-
High 8.8
IXP Manager has authenticated non-administrator privilege escalation
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure bu…
-
High 8.7
Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin.…
-
Critical 9.3
Kargo: Privilege escalation via Project RBAC management in the Kargo API
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `Service…
-
High 8.8
Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_…
-
High 7.4
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability …
-
High 7.8
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low pri…
-
Medium 6.5
Credential exposure to space supporter
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom build…