Weakness (CWE)
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it (3 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-269
3,024 results · Feed
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allo…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have all…
-
Medium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have a…
-
High 7.8
VMware Aria Operations updates address a local privilege escalation vulnerability (CVE-2025-22231)
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privileges to root on the appliance running VMware Aria Operations.
-
Critical 9.8
WP RealEstate <= 1.6.26 - Unauthenticated Privilege Escalation via 'process_register'
The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for u…
-
High 7.3
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index…
-
High 8.8
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma …
-
Critical 9.8
An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.
-
High 8.5
Privilege escalation vulnerability in saTECH BCU
Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser.
-
High 7.3
A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker …
-
Medium 5.5
Accountsservice incorrectly drops privileges
accountsservice no longer drops permissions when writting .pam_environment
-
High 7.4
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to esca…
-
High 7.4
Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to esca…
-
High 8.7
XWiki uses the wrong wiki reference in AuthorizationManager
XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through the REST API - but could also be through another API - when a sub wiki is using "Prevent unregistere…
-
Medium 5.9
A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder
Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2…
-
Medium 5.5
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Man…
-
Critical 9.8
Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function…
-
High 8.8
Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the _ajax_get_total_content_import_items() function in all versions up to, and including, 1.7.8. T…
-
Medium 5.5
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
-
Medium 6.7
An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive inf…
-
Medium 6.7
Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability
Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
-
Medium 4.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 6.4
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.4
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.3
Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: fr…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 1…
-
Critical 9.8
Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup
The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticat…
-
High 7.2
Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta…
-
Medium 6.8
Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an…
-
Critical 9.8
Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register
The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauth…
-
Critical 9.8
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attack…
-
High 8.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Esc…
-
High 7.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privileg…
-
High 8.6
Privilege Escalation Through SUID Binary and Developer Mode
A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. This issue affects InkPad Color 3 in version U743k3.6.8.3671.
-
Medium 4.7
File Read Through Improper Sudo Privilege Management
A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671.
-
Medium 6.5
Apache StreamPipes: Resources Permission Escalation
Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the …
-
High 7.1
Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave
The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the create_autosave AJAX function. This makes it possible for authenticated attackers, …
-
High 8.8
Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege Escalation
The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-…