CWE-269— Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog
5,416 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-269page 81 of 109
- CVE-2017-14484HIGHCVSS 7.3EG 7.32017-09-15
The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a hard link under /var/lib/gimps, because an unsafe "chown -R" command is executed.
- CVE-2024-52926HIGHCVSS 6.5EG 7.32024-11-18
Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent.
- CVE-2022-3421HIGHCVSS 5.6EG 7.32022-10-17
An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a…
- CVE-2026-18513HIGHCVSS 7.2EG 7.22026-10-12
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
- CVE-2026-109567HIGHCVSS 7.2EG 7.22026-10-12
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles …
- CVE-2026-109317HIGHCVSS 7.2EG 7.22026-10-12
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edi…
- CVE-2026-85126HIGHCVSS 7.2EG 7.22026-10-11
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, le…
- CVE-2026-104680HIGHCVSS 7.2EG 7.22026-10-11
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery Wo…
- CVE-2026-105126HIGHCVSS 7.2EG 7.22026-10-03
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin o…
- CVE-2026-102093HIGHCVSS 7.2EG 7.22026-09-30
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-manag…
- CVE-2026-76713HIGHCVSS 7.2EG 7.22026-09-22
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file syst…
- CVE-2026-12470HIGHCVSS 7.2EG 7.22026-09-22
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' A…
- CVE-2025-71421HIGHCVSS 7.2EG 7.22026-09-21
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their…
- CVE-2026-92541HIGHCVSS 7.2EG 7.22026-09-20
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existin…
- CVE-2026-92540HIGHCVSS 7.2EG 7.22026-09-20
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new ad…
- CVE-2026-76554HIGHCVSS 7.2EG 7.22026-09-19
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress pl…
- CVE-2026-92619HIGHCVSS 7.2EG 7.22026-09-18
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function ap…
- CVE-2026-81810HIGHCVSS 7.2EG 7.22026-09-18
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export t…
- CVE-2026-81445HIGHCVSS 7.2EG 7.22026-09-17
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of …
- CVE-2026-85569HIGHCVSS 7.2EG 7.22026-09-16
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-o…
- CVE-2026-87246HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with ne…
- CVE-2026-87244HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with ne…
- CVE-2026-87239HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with ne…
- CVE-2026-87207HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with ne…
- CVE-2026-83482HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows high privileged attacker with net…
- CVE-2026-83481HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows high privileged attacker with net…
- CVE-2026-83453HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high p…
- CVE-2026-83442HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with ne…
- CVE-2026-83440HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with ne…
- CVE-2026-83344HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allo…
- CVE-2026-83328HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker …
- CVE-2026-83325HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows …
- CVE-2026-83322HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows …
- CVE-2026-83298HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network a…
- CVE-2026-83273HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 26.01.0.0.0. Easily exploitable vulnerability allows high privileg…
- CVE-2026-83195HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows high privileged attacker with network …
- CVE-2026-83176HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privilege…
- CVE-2026-83117HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network acc…
- CVE-2026-83112HIGHCVSS 7.2EG 7.22026-09-15
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows high privileged…
- CVE-2026-80071HIGHCVSS 7.2EG 7.22026-09-13
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access …
- CVE-2026-77752HIGHCVSS 7.2EG 7.22026-09-12
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a sin…
- CVE-2026-74925HIGHCVSS 7.2EG 7.22026-09-11
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- CVE-2026-81431HIGHCVSS 7.2EG 7.22026-09-10
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controll…
- CVE-2026-75927HIGHCVSS 7.2EG 7.22026-09-09
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCa…
- CVE-2026-17553HIGHCVSS 7.2EG 7.22026-09-09
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly…
- CVE-2026-79996HIGHCVSS 7.2EG 7.22026-08-28
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin bef…
- CVE-2026-13415HIGHCVSS 7.2EG 7.22026-08-27
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the C…
- CVE-2026-36102HIGHCVSS 7.2EG 7.22026-08-27
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
- CVE-2026-75971HIGHCVSS 7.2EG 7.22026-08-25
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function bei…
- CVE-2026-75796HIGHCVSS 7.2EG 7.22026-08-21
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Mul…
Map vulnerabilities like CWE-269 to your infrastructure
EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →