CWE-266— Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

1,100 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-266page 16 of 22

CVE-2026-12823LOWCVSS 3.3EG 3.3
2026-06-22
A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a…
CVE-2026-13511LOWCVSS 3.1EG 3.1
2026-06-28
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a man…
CVE-2026-13524MEDIUMCVSS 5.6EG 5.6
2026-06-29
A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. This vulnerability affects unknown code of the file src/main/services/mcp/oauth/callback.ts of the component MCP OAuth Local Callback Server. The manipulatio…
CVE-2026-13544MEDIUMCVSS 6.3EG 6.3
2026-06-29
A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The …
CVE-2026-13568HIGHCVSS 7.3EG 7.3
2026-06-29
A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument rol…
CVE-2026-13591MEDIUMCVSS 5.0EG 5.0
2026-06-29
A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument _channelType causes impr…
CVE-2026-1411MEDIUMCVSS 6.1EG 6.1
2026-01-26
A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulation causes improper access controls. It is feasible to perform the attack on the …
CVE-2026-14690HIGHCVSS 7.3EG 7.3
2026-07-05
A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of…
CVE-2026-14693MEDIUMCVSS 5.4EG 5.4
2026-07-05
A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel_order of the file classes/Master.php. Executing a manipulation can lead to improper authorizat…
CVE-2026-14719HIGHCVSS 7.3EG 7.3
2026-07-05
A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.php of the component Registration Endpoint. Executing a manipulation of the argume…
CVE-2026-14778HIGHCVSS 7.3EG 7.3
2026-07-05
A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argu…
CVE-2026-14792MEDIUMCVSS 6.5EG 6.5
2026-07-06
A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remot…
CVE-2026-14794MEDIUMCVSS 4.3EG 4.3
2026-07-06
A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument us…
CVE-2026-15188MEDIUMCVSS 6.3EG 6.3
2026-07-09
A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component …
CVE-2026-15218HIGHCVSS 7.9EG 7.9
2026-08-17
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identi…
CVE-2026-15270HIGHCVSS 7.5EG 7.5
2026-07-09
A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privil…
CVE-2026-15271HIGHCVSS 7.5EG 7.5
2026-07-09
A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web …
CVE-2026-15319HIGHCVSS 7.3EG 7.3
2026-07-10
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_control.go of the component Launcher. Such manipulation leads to improper access con…
CVE-2026-15373MEDIUMCVSS 6.3EG 6.3
2026-07-10
A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It i…
CVE-2026-15374MEDIUMCVSS 6.3EG 6.3
2026-07-10
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is poss…
CVE-2026-15375MEDIUMCVSS 4.3EG 4.3
2026-07-10
A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack…
CVE-2026-15376MEDIUMCVSS 6.3EG 6.3
2026-07-10
A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulation results in improper authorization. The attack can be launched remotely. The …
CVE-2026-15377MEDIUMCVSS 4.3EG 4.3
2026-07-10
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiat…
CVE-2026-15467HIGHCVSS 8.1EG 8.1
2026-08-10
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user…
CVE-2026-15470MEDIUMCVSS 4.3EG 4.3
2026-07-11
A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Such manipulation leads to improper authorization. The attack may be launched remo…
CVE-2026-15471MEDIUMCVSS 4.3EG 4.3
2026-07-12
A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is poss…
CVE-2026-15472MEDIUMCVSS 4.3EG 4.3
2026-07-12
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a manipulation can lead to improper authorization. The attack can be exec…
CVE-2026-15473MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authoriza…
CVE-2026-15474MEDIUMCVSS 4.3EG 4.3
2026-07-12
A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in imprope…
CVE-2026-15475MEDIUMCVSS 5.3EG 5.3
2026-07-12
A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Driver. This manipulation causes improper access controls. The at…
CVE-2026-15476MEDIUMCVSS 5.3EG 5.3
2026-07-12
A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The atta…
CVE-2026-15499MEDIUMCVSS 6.3EG 6.3
2026-07-12
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a manipulation of the ar…
CVE-2026-1550HIGHCVSS 8.8EG 8.8
2026-01-28
A security flaw has been discovered in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /hms/hospital/docappsystem/adminviews.py of the component Admin Dashboard Page. Performing a…
CVE-2026-15509MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carr…
CVE-2026-15510MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made p…
CVE-2026-15594LOWCVSS 3.7EG 3.7
2026-07-13
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in imp…
CVE-2026-1597HIGHCVSS 8.8EG 8.8
2026-01-29
A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such manipulation of the argument ci_session leads to improper authorization. The attack…
CVE-2026-16121MEDIUMCVSS 6.3EG 6.3
2026-07-18
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation leads to improper authorization. It is possible to initiate the attack…
CVE-2026-16199MEDIUMCVSS 6.3EG 6.3
2026-07-19
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed_exec.go. Executing a manipulation can lead to improper authorization. The attac…
CVE-2026-16224MEDIUMCVSS 4.3EG 4.3
2026-07-19
A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploit…
CVE-2026-16764MEDIUMCVSS 6.3EG 6.3
2026-07-23
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privile…
CVE-2026-1702HIGHCVSS 8.8EG 8.8
2026-01-30
A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of the component User Management. Performing a manipulation of the argument group_id…
CVE-2026-1712MEDIUMCVSS 5.8EG 5.8
2026-03-25
Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server: from 10.5.1 before 10.7.
CVE-2026-1733MEDIUMCVSS 4.3EG 4.3
2026-02-01
A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. The manipulation of the argument order_id leads to improper authorization. The at…
CVE-2026-17432MEDIUMCVSS 5.0EG 5.0
2026-07-26
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. Th…
CVE-2026-17433MEDIUMCVSS 5.3EG 5.3
2026-07-26
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in impr…
CVE-2026-17434MEDIUMCVSS 6.3EG 6.3
2026-07-26
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. …
CVE-2026-17626HIGHCVSS 8.8EG 8.8
2026-08-05
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mappi…
CVE-2026-18584MEDIUMCVSS 5.4EG 5.4
2026-08-03
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper author…
CVE-2026-18606HIGHCVSS 7.8EG 7.8
2026-08-03
A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Ha…

Map vulnerabilities like CWE-266 to your infrastructure

EchelonGraph correlates every CVE — across CWE-266 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →