Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,024 results · Feed
-
High 7.8
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to dis…
-
High 7.8
In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code…
-
High 7.8
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to dis…
-
Critical 9.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384.
-
High 8.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223.
-
Critical 9.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106.
-
High 8.8
-
Critical 9.8
-
Medium 5.3
An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges…
-
High 8.1
Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical sy…
-
Medium 4.3
Contao has improper privilege management for page and article fields
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in ver…
-
High 7.5
GLPI permits unauthorized rules execution order
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user witho…
-
Medium 6.6
D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly…
-
High 7.2
RACOM M!DGE2 Privilege Escalation via SDK Testing Endpoint
A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access w…
-
High 8.8
Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation
The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function.…
-
High 8.8
Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff pass…
-
High 8.8
An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases …
-
High 8.8
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation
Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a ne…
-
Medium 5.3
Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662…
-
High 7.3
D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-…
-
High 7.8
An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMedia…
-
High 8.1
User privilege escalation vulnerability
There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDe…
-
High 8.5
Root Certificate Injection
The StrongDM Windows service incorrectly handled communication related to system certificate management. Attackers could exploit this behavior to install untrusted root certificates or remove trusted ones.
-
Medium 6.7
CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code ex…
-
Critical 9.8CVE-2025-6758 Public exploit
Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. T…
-
High 8.8
Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role.…
-
High 8.8
WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This is due to the plugin not properly validating a user's capabilities prior to adding users. …
-
Medium 4.3
In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout.
-
Medium 4.3
In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges bec…
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
Medium 5.6
Privilege Escalation in Symantec PGP Encryption 11.0.1
Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.
-
High 7.2
OpenBao Root Namespace Operator May Elevate Token Privileges
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, accounts with access to highly-privileged identity entity systems in root namespaces were abl…
-
High 7.0
The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when suc…
-
Critical 9.8
Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation
The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user…
-
Critical 9.1CVE-2025-54594 Public exploit
react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration
react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untr…
-
High 8.5CVE-2013-10052 Public exploit
ZPanel zsudo Local Privilege Escalation
ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw…
-
High 8.5CVE-2012-10022 Public exploit
Kloxo <= 6.1.12 Local Privilege Escalation
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matc…
-
High 7.3
Pearcleaner's unauthenticated access to privileged XPC helper allows root command execution
Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner application. It is registered and activated only after the user approves a system prompt to allow pr…
-
Critical 9.8
Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation
The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the ao…
-
High 8.0CVE-2025-52289 Public exploit
A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privile…