CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

5,412 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 77 of 109

CVE-2025-29924HIGHCVSS 7.5EG 7.5
2025-03-19
XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through the REST API - but could also be through another API - when a sub wiki is using …
CVE-2021-3978HIGHCVSS 7.5EG 7.5
2025-01-29
When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/pack…
CVE-2025-21343HIGHCVSS 7.5EG 7.5
2025-01-14
Windows Web Threat Defense User Service Information Disclosure Vulnerability
CVE-2024-22893HIGHCVSS 7.5EG 7.5
2024-09-25
OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.
CVE-2024-42774HIGHCVSS 7.5EG 7.5
2024-08-22
An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section.
CVE-2024-39206HIGHCVSS 7.5EG 7.5
2024-07-02
An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings.list being encrypted with a hard coded key.
CVE-2024-4988HIGHCVSS 7.5EG 7.5
2024-05-21
The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.
CVE-2024-31237HIGHCVSS 7.5EG 7.5
2024-05-17
Improper Privilege Management vulnerability in WP Sharks s2Member Pro allows Privilege Escalation.This issue affects s2Member Pro: from n/a through 240315.
CVE-2024-0097HIGHCVSS 7.5EG 7.5
2024-05-14
NVIDIA ChatRTX for Windows contains a vulnerability in ChatRTX UI, where a user can cause an improper privilege management issue by exploiting interprocess communication between different processes. A successful exploit of this vulnerabili…
CVE-2024-0096HIGHCVSS 7.5EG 7.5
2024-05-14
NVIDIA ChatRTX for Windows contains a vulnerability in Chat RTX UI, where a user can cause an improper privilege management issue by sending user inputs to change execution flow. A successful exploit of this vulnerability might lead to inf…
CVE-2024-33398HIGHCVSS 7.5EG 7.5
2024-05-03
There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the service account bound to this ClusterRole and use its high-risk privileges to list co…
CVE-2023-52716HIGHCVSS 7.5EG 7.5
2024-04-07
Vulnerability of starting activities in the background in the ActivityManagerService (AMS) module. Impact: Successful exploitation of this vulnerability will affect availability.
CVE-2024-28197HIGHCVSS 7.5EG 7.5
2024-03-11
Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie was handled according to best practices, it was accessible on subdomains of the ZI…
CVE-2024-25842HIGHCVSS 7.5EG 7.5
2024-03-03
An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information …
CVE-2023-52105HIGHCVSS 7.5EG 7.5
2024-01-16
The nearby module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect availability.
CVE-2023-52116HIGHCVSS 7.5EG 7.5
2024-01-16
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
CVE-2023-52114HIGHCVSS 7.5EG 7.5
2024-01-16
Data confidentiality vulnerability in the ScreenReader module. Successful exploitation of this vulnerability may affect service integrity.
CVE-2023-52107HIGHCVSS 7.5EG 7.5
2024-01-16
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-39167HIGHCVSS 7.5EG 7.5
2023-12-07
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
CVE-2023-46758HIGHCVSS 7.5EG 7.5
2023-11-08
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
CVE-2023-5978HIGHCVSS 7.5EG 7.5
2023-11-08
In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. When only a list of reso…
CVE-2023-46771HIGHCVSS 7.5EG 7.5
2023-11-08
Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-43018HIGHCVSS 7.5EG 7.5
2023-11-03
IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: …
CVE-2023-41309HIGHCVSS 7.5EG 7.5
2023-09-27
Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availability.
CVE-2023-39375HIGHCVSS 7.5EG 7.5
2023-09-27
SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges
CVE-2023-41301HIGHCVSS 7.5EG 7.5
2023-09-25
Vulnerability of unauthorized API access in the PMS module. Successful exploitation of this vulnerability may cause features to perform abnormally.
CVE-2023-4278HIGHCVSS 7.5EG 7.5
2023-09-11
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
CVE-2023-32457HIGHCVSS 7.5EG 7.5
2023-08-29
Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentially exploit this vulnerability, leading to escalation of privileges.
CVE-2021-35309HIGHCVSS 7.5EG 7.5
2023-08-22
An issue discovered in Samsung SyncThru Web Service SPL 5.93 06-09-2014 allows attackers to gain escalated privileges via MITM attacks.
CVE-2022-48515HIGHCVSS 7.5EG 7.5
2023-07-06
Vulnerability of inappropriate permission control in Nearby. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-25521HIGHCVSS 7.5EG 7.5
2023-07-04
NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby proper input parameter validation is not performed. A successful exploit of thi…
CVE-2023-1694HIGHCVSS 7.5EG 7.5
2023-05-20
The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.
CVE-2023-1693HIGHCVSS 7.5EG 7.5
2023-05-20
The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.
CVE-2023-29350HIGHCVSS 7.5EG 7.5
2023-05-05
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-48286HIGHCVSS 7.5EG 7.5
2023-02-09
The multi-screen collaboration module has a privilege escalation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVE-2022-48279HIGHCVSS 7.5EG 7.5
2023-01-20
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSe…
CVE-2023-22331HIGHCVSS 7.5EG 7.5
2023-01-20
Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials information.
CVE-2022-0222HIGHCVSS 7.5EG 7.5
2022-11-22
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* vers…
CVE-2022-20918HIGHCVSS 7.5EG 7.5
2022-11-15
A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module, Cisco Firepower Management Center (FMC) Software, and Cisco Next-Generati…
CVE-2021-34579HIGHCVSS 7.5EG 7.5
2022-11-09
In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers…
CVE-2022-39422HIGHCVSS 7.5EG 7.5
2022-10-18
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the in…
CVE-2022-3422HIGHCVSS 7.5EG 7.5
2022-10-07
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
CVE-2022-3079HIGHCVSS 7.5EG 7.5
2022-09-20
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
CVE-2021-0891HIGHCVSS 7.5EG 7.5
2022-08-24
An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Product: AndroidVersions: Android SoCAndroid ID: A-236849490
CVE-2022-22037HIGHCVSS 7.5EG 7.5
2022-07-12
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVE-2022-31257HIGHCVSS 7.5EG 7.5
2022-07-12
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.18), Mendix Applications using Mendix 9 (All versions < V9.14.0), Mendix Applicat…
CVE-2022-22390HIGHCVSS 7.5EG 7.5
2022-06-24
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when table function is used. IBM X-Force ID: 221973.
CVE-2022-30150HIGHCVSS 7.5EG 7.5
2022-06-15
Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability
CVE-2022-29179HIGHCVSS 7.5EG 7.5
2022-05-20
Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a conta…
CVE-2022-22257HIGHCVSS 7.5EG 7.5
2022-04-11
The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →