CWE-269— Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

5,416 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-269page 85 of 109

CVE-2023-51435HIGHCVSS 7.1EG 7.1
2023-12-29
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
CVE-2023-36024HIGHCVSS 7.1EG 7.1
2023-11-10
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2020-23362HIGHCVSS 7.1EG 7.1
2023-05-09
Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privileges via the cover_id parameter.
CVE-2023-28758HIGHCVSS 7.1EG 7.1
2023-03-23
An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. This can be used to overwrite existing NetBackup log files.
CVE-2022-42855HIGHCVSS 7.1EG 7.1
2022-12-15
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to use arbitrary entitlemen…
CVE-2022-37971HIGHCVSS 7.1EG 7.1
2022-10-11
Microsoft Windows Defender Elevation of Privilege Vulnerability
CVE-2022-30226HIGHCVSS 7.1EG 7.1
2022-07-12
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-30225HIGHCVSS 7.1EG 7.1
2022-07-12
Windows Media Player Network Sharing Service Elevation of Privilege Vulnerability
CVE-2022-21827HIGHCVSS 7.1EG 7.1
2022-05-26
An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in i…
CVE-2022-29164HIGHCVSS 7.1EG 7.1
2022-05-06
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a …
CVE-2022-23273HIGHCVSS 7.1EG 7.1
2022-02-09
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
CVE-2022-21997HIGHCVSS 7.1EG 7.1
2022-02-09
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-0144HIGHCVSS 7.1EG 7.1
2022-01-11
shelljs is vulnerable to Improper Privilege Management
CVE-2021-39944HIGHCVSS 7.1EG 7.1
2021-12-13
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group…
CVE-2021-43211HIGHCVSS 7.1EG 7.1
2021-11-24
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVE-2021-31360HIGHCVSS 7.1EG 7.1
2021-10-19
An improper privilege management vulnerability in the Juniper Networks Junos OS and Junos OS Evolved command-line interpreter (CLI) allows a low-privileged user to overwrite local files as root, possibly leading to a system integrity issue…
CVE-2021-40354HIGHCVSS 7.1EG 7.1
2021-09-14
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" funct…
CVE-2021-1092HIGHCVSS 7.1EG 7.1
2021-07-22
NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows file system symbolic link attack where an unprivileged attacker can cause the applications to overw…
CVE-2021-22326HIGHCVSS 7.1EG 7.1
2021-06-30
A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space read/write capability.
CVE-2021-28692HIGHCVSS 7.1EG 7.1
2021-06-30
inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completi…
CVE-2020-29031HIGHCVSS 7.1EG 7.1
2021-02-15
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue af…
CVE-2020-17089HIGHCVSS 7.1EG 7.1
2020-12-10
Microsoft SharePoint Elevation of Privilege Vulnerability
CVE-2020-16877HIGHCVSS 7.1EG 7.1
2020-10-16
<p>An elevation of privilege vulnerability exists when Microsoft Windows improperly handles reparse points. An attacker who successfully exploited this vulnerability could overwrite or delete a targeted file that would normally require ele…
CVE-2020-16876HIGHCVSS 7.1EG 7.1
2020-10-16
<p>An elevation of privilege vulnerability exists when the Windows Application Compatibility Client Library improperly handles registry operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</…
CVE-2020-16852HIGHCVSS 7.1EG 7.1
2020-09-11
<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could overwrite a targeted file with an elevat…
CVE-2020-13522HIGHCVSS 7.1EG 7.1
2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send …
CVE-2020-1461HIGHCVSS 7.1EG 7.1
2020-07-14
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elev…
CVE-2020-1405HIGHCVSS 7.1EG 7.1
2020-07-14
An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability'. This CVE ID is un…
CVE-2020-14974HIGHCVSS 7.1EG 7.1
2020-06-23
The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running as SYSTEM) that hold a handle, via IOCTL code 0x222124.
CVE-2020-14990HIGHCVSS 7.1EG 7.1
2020-06-22
IOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion by manipulating the Clean & Optimize feature with an NTFS junction and an Object Manager symbolic link.
CVE-2020-1204HIGHCVSS 7.1EG 7.1
2020-06-09
An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability'.
CVE-2020-1002HIGHCVSS 7.1EG 7.1
2020-04-15
An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elev…
CVE-2020-0942HIGHCVSS 7.1EG 7.1
2020-04-15
An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. This CVE …
CVE-2020-0936HIGHCVSS 7.1EG 7.1
2020-04-15
An elevation of privilege vulnerability exists when a Windows scheduled task improperly handles file redirections, aka 'Windows Scheduled Task Elevation of Privilege Vulnerability'.
CVE-2020-0556HIGHCVSS 7.1EG 7.1
2020-03-12
Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access
CVE-2020-0854HIGHCVSS 7.1EG 7.1
2020-03-12
An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability'.
CVE-2020-0785HIGHCVSS 7.1EG 7.1
2020-03-12
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.
CVE-2019-11154HIGHCVSS 7.1EG 7.1
2019-11-14
Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
CVE-2019-18845HIGHCVSS 7.1EG 7.1
2019-11-09
The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \…
CVE-2019-11896HIGHCVSS 7.1EG 7.1
2019-05-29
A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to e…
CVE-2019-3786HIGHCVSS 7.1EG 7.1
2019-04-24
Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to reque…
CVE-2018-5839HIGHCVSS 7.1EG 7.1
2019-02-25
Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9150, MDM9615, MD…
CVE-2018-0751HIGHCVSS 7.1EG 7.1
2018-01-04
The Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way th…
CVE-2017-6767HIGHCVSS 7.1EG 7.1
2017-08-17
A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher privileges than the account is assigned. The attacker will be granted the privileges of the last user…
CVE-2021-31836HIGHCVSS 5.6EG 7.1
2021-09-22
Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a l…
CVE-2026-28548HIGHCVSS 5.5EG 7.1
2026-03-05
Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-53614HIGHCVSS 7.0EG 7.0
2026-10-14
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowin…
CVE-2026-83597HIGHCVSS 7.0EG 7.0
2026-09-22
Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-priv…
CVE-2026-63349HIGHCVSS 7.0EG 7.0
2026-09-18
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process…
CVE-2026-87240HIGHCVSS 7.0EG 7.0
2026-09-15
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with l…

Map vulnerabilities like CWE-269 to your infrastructure

EchelonGraph correlates every CVE — across CWE-269 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →