cve.bz

CWE-266: Incorrect Privilege Assignment, page 8

Filter

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-266 at MITRE

Ask an AI about CWE-266

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-266: Incorrect Privilege Assignment and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/266.html and https://cve.bz/cve/cwe/266?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2025-59563EPSS 0.4%

    Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.

  2. 2.3CVE-2026-53862EPSS 0.09%

    OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing a…

  3. 5.3CVE-2026-53847EPSS 0.2%

    OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. At…

  4. 9.6CVE-2026-12294EPSS 0.4%

    Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  5. 8.8CVE-2026-12289EPSS 0.4%

    Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  6. 8.8CVE-2026-49780EPSS 0.3%

    Customer Privilege Escalation in Dokan <= 5.0.2 versions.

  7. 7.5CVE-2026-49083EPSS 0.3%

    Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.

  8. 7.3CVE-2026-49063EPSS 0.2%

    Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.

  9. 8.8CVE-2026-48889EPSS 0.4%

    Subscriber Privilege Escalation in Amelia <= 2.3 versions.

  10. 8.1CVE-2026-39587EPSS 0.3%

    Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

  11. 9.8CVE-2026-39583EPSS 0.4%

    Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

  12. 8.8CVE-2026-39579EPSS 0.3%

    Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

  13. 7.2CVE-2026-39470EPSS 0.4%

    Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.

  14. 9.8CVE-2026-34901EPSS 0.3%

    Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

  15. 7.2CVE-2026-27407EPSS 0.4%

    Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

  16. 8.8CVE-2026-49111EPSS 0.2%

    Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.

  17. 7.1CVE-2026-12217EPSS 0.1%

    A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege management. An atta…

  18. 2.1CVE-2026-12213EPSS 0.2%

    A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/src/operations.ts of the component User Information Handler. The manipulation re…

  19. 2.1CVE-2026-12212EPSS 0.2%

    A vulnerability has been found in hcengineering Huly Platform up to 0.7.0. Affected is the function getMailboxSecret of the file server/account/src/operations.ts of the component RPC Interface. The manipulation leads to improper access con…

  20. 1.9CVE-2026-12201EPSS 0.1%

    A flaw has been found in IObit Malware Fighter up to 13.2.0. Affected by this vulnerability is an unknown functionality of the component DLL Handler. This manipulation causes permission issues. The attack requires local access. The exploit…

  21. 5.3CVE-2026-44173EPSS 0.6%

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SE…

  22. 8.8CVE-2026-45830EPSS 0.3%

    A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belon…

  23. 9.8CVE-2026-49060ExploitEPSS 1.8%

    Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

  24. 8.7CVE-2026-53814EPSS 0.3%

    OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid hook token can exploi…

  25. 7.5CVE-2026-47169EPSS 0.3%

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a user with Manage Server / ManageGuild, but without Manage Roles or Administrator, can configure the bot’s AutoRole feature…

  26. 7.8CVE-2026-45490EPSS 0.4%

    Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

  27. 9.1CVE-2025-10263EPSS 0.5%

    Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow…

  28. 5.5CVE-2026-11620EPSS 0.3%

    A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the a…

  29. 2.1CVE-2026-11619EPSS 0.2%

    A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads t…

  30. 2.9CVE-2026-11555EPSS 0.4%

    A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Interface. Such manipulation leads to least privilege violation. The attack may be l…

  31. 2.1CVE-2026-11554EPSS 0.2%

    A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated rem…

  32. 2.1CVE-2026-11533EPSS 0.2%

    A security vulnerability has been detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this vulnerability is an unknown functionality of the file /see.php of the component Student Delet…

  33. 2.1CVE-2026-11532EPSS 0.3%

    A weakness has been identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected is an unknown function of the file /add.php of the component Student Record Handler. Executing a manipulation can…

  34. 2.1CVE-2026-11521EPSS 0.3%

    A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controll…

  35. 2.1CVE-2026-11519EPSS 0.3%

    A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The mani…

  36. 5.5CVE-2026-11497EPSS 0.4%

    A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation…

  37. 2.1CVE-2026-11494EPSS 0.2%

    A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be in…

  38. 2.1CVE-2026-11492EPSS 0.5%

    A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack c…

  39. 2.1CVE-2026-11476EPSS 0.2%

    A security vulnerability has been detected in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this issue is the function edit-admin of the file controllers/AdminController.php of the component…

  40. 2.1CVE-2026-11466EPSS 0.3%

    A weakness has been identified in zilliztech deep-searcher up to 0.0.2. This affects the function CollectionRouter.invoke of the file deepsearcher/agent/collection_router.py. This manipulation of the argument kwargs causes improper access …

  41. 5.5CVE-2026-11462EPSS 0.3%

    A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipul…

  42. 5.3CVE-2026-11441EPSS 0.2%

    A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper a…

  43. 5.3CVE-2026-11440EPSS 0.2%

    A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes im…

  44. 5.3CVE-2026-11439EPSS 0.2%

    A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in i…

  45. 5.3CVE-2026-11438EPSS 0.2%

    A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The a…

  46. 2.1CVE-2026-11336EPSS 0.2%

    A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the com…

  47. 2.1CVE-2026-10876EPSS 0.3%

    A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of t…

  48. 8.8CVE-2025-15656EPSS 0.2%

    Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.

  49. 2.1CVE-2026-10693EPSS 0.2%

    A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper author…

  50. 9.8CVE-2025-53209EPSS 0.3%

    Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.