CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

5,416 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 83 of 109

CVE-2024-33569HIGHCVSS 7.2EG 7.2
2024-05-17
Improper Privilege Management vulnerability in Darren Cooney Instant Images allows Privilege Escalation.This issue affects Instant Images: from n/a through 6.1.0.
CVE-2023-51546HIGHCVSS 7.2EG 7.2
2024-05-17
Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and…
CVE-2023-47682HIGHCVSS 7.2EG 7.2
2024-05-17
Improper Privilege Management vulnerability in weDevs WP User Frontend allows Privilege Escalation.This issue affects WP User Frontend: from n/a through 3.6.5.
CVE-2023-37866HIGHCVSS 7.2EG 7.2
2024-05-17
Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.0.8.
CVE-2024-22264HIGHCVSS 7.2EG 7.2
2024-05-08
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer can create, modify, execute and delete files as a root user on the host system.
CVE-2024-21324HIGHCVSS 7.2EG 7.2
2024-04-09
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2023-40289HIGHCVSS 7.2EG 7.2
2024-03-27
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.
CVE-2023-25535HIGHCVSS 7.2EG 7.2
2024-02-14
Dell SupportAssist for Home PCs Installer Executable file version prior to 3.13.2.19 used for initial installation has a high vulnerability that can result in local privilege escalation (LPE). This vulnerability only affects first-time in…
CVE-2023-6218HIGHCVSS 7.2EG 7.2
2023-11-29
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrat…
CVE-2023-4822HIGHCVSS 7.2EG 7.2
2023-10-16
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permission…
CVE-2023-33972HIGHCVSS 7.2EG 7.2
2023-09-27
Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even …
CVE-2023-37859HIGHCVSS 7.2EG 7.2
2023-08-09
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 the SNMP daemon is running with root privileges allowing a remote attacker with knowledge of the SNMPv2 r/w community string to execute system commands as root.
CVE-2023-4009HIGHCVSS 7.2EG 7.2
2023-08-08
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege es…
CVE-2022-48365HIGHCVSS 7.2EG 7.2
2023-03-12
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVE-2022-43759HIGHCVSS 7.2EG 7.2
2023-02-07
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prio…
CVE-2022-38757HIGHCVSS 7.2EG 7.2
2022-12-23
A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exer…
CVE-2022-31707HIGHCVSS 7.2EG 7.2
2022-12-16
vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
CVE-2022-42459HIGHCVSS 7.2EG 7.2
2022-11-18
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
CVE-2022-31672HIGHCVSS 7.2EG 7.2
2022-08-10
VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.
CVE-2022-30616HIGHCVSS 7.2EG 7.2
2022-08-01
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978.
CVE-2021-36784HIGHCVSS 7.2EG 7.2
2022-05-02
A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.
CVE-2022-27421HIGHCVSS 7.2EG 7.2
2022-04-15
Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
CVE-2022-26251HIGHCVSS 7.2EG 7.2
2022-04-06
The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.
CVE-2022-23284HIGHCVSS 7.2EG 7.2
2022-03-09
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2021-46075HIGHCVSS 7.2EG 7.2
2022-01-06
A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations.
CVE-2021-43835HIGHCVSS 7.2EG 7.2
2021-12-15
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them t…
CVE-2021-35534HIGHCVSS 7.2EG 7.2
2021-11-18
Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product do…
CVE-2021-29792HIGHCVSS 7.2EG 7.2
2021-07-12
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450.
CVE-2021-30462HIGHCVSS 7.2EG 7.2
2021-04-08
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts.
CVE-2021-20072HIGHCVSS 7.2EG 7.2
2021-02-16
Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral.
CVE-2020-4912HIGHCVSS 7.2EG 7.2
2021-01-04
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
CVE-2020-12594HIGHCVSS 7.2EG 7.2
2020-12-10
A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4.
CVE-2020-4685HIGHCVSS 7.2EG 7.2
2020-11-11
A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access…
CVE-2020-24046HIGHCVSS 7.2EG 7.2
2020-09-17
A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after cha…
CVE-2020-24045HIGHCVSS 7.2EG 7.2
2020-09-17
A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. The restricted shell can be bypassed by present…
CVE-2020-4638HIGHCVSS 7.2EG 7.2
2020-09-03
IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation. An invitee to an API Provider organization can escalate privileges by manipulating the invitation link. IBM X-Force ID: 185508.
CVE-2020-4603HIGHCVSS 7.2EG 7.2
2020-08-27
IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 184880.
CVE-2020-12736HIGHCVSS 7.2EG 7.2
2020-07-07
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify …
CVE-2020-5907HIGHCVSS 7.2EG 7.2
2020-07-01
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the bui…
CVE-2020-7509HIGHCVSS 7.2EG 7.2
2020-06-16
A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to elevate their privileges and delete files.
CVE-2020-6090HIGHCVSS 7.2EG 7.2
2020-06-11
An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of HTTP requests can cause code execution resulting in remote code execution. An at…
CVE-2020-12713HIGHCVSS 7.2EG 7.2
2020-06-11
An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have multip…
CVE-2020-13695HIGHCVSS 7.2EG 7.2
2020-06-01
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /ro…
CVE-2020-12473HIGHCVSS 7.2EG 7.2
2020-04-29
MonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting from ffmpeg.exe to a different program.
CVE-2020-6236HIGHCVSS 7.2EG 7.2
2020-04-14
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results i…
CVE-2020-6234HIGHCVSS 7.2EG 7.2
2020-04-14
SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating system, leading to Privilege Escalation.
CVE-2019-19699HIGHCVSS 7.2EG 7.2
2020-04-06
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify…
CVE-2020-5291HIGHCVSS 7.2EG 7.2
2020-03-31
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable.…
CVE-2020-4163HIGHCVSS 7.2EG 7.2
2020-02-04
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 1…
CVE-2019-7479HIGHCVSS 7.2EG 7.2
2019-12-31
A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5…

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →