CWE-266
1,010 CVEs • Abstraction: Base
Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CVEs (1,010)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions. |
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to...Show more |
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.a...Show more |
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |
Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |
Customer Privilege Escalation in Dokan <= 5.0.2 versions. |
Contributor Privilege Escalation in LatePoint <= 5.5.1 versions. |
Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions. |
Subscriber Privilege Escalation in Amelia <= 2.3 versions. |
Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions. |
Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. |
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions. |
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions. |
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. |
Editor Privilege Escalation in AI Engine <= 3.4.9 versions. |
Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation.
This issue affects Masteriyo - LMS: from n/a through 2.2.0. |
A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege...Show more |
A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/src/operations.ts of the component User Information Handler....Show more |
A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to...Show more |
A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This manipulation causes permission issues. The attack requires local...Show more |