CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
2345 vulnerabilities reference this CWE, most recent first.
GHSA-223P-M2W6-92V2
Vulnerability from github – Published: 2025-04-09 15:32 – Updated: 2025-04-09 15:32IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.
{
"affected": [],
"aliases": [
"CVE-2025-25023"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-09T14:15:28Z",
"severity": "MODERATE"
},
"details": "IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.",
"id": "GHSA-223p-m2w6-92v2",
"modified": "2025-04-09T15:32:23Z",
"published": "2025-04-09T15:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25023"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7230467"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-22G3-53PR-G6HG
Vulnerability from github – Published: 2025-04-04 15:31 – Updated: 2026-04-28 21:35Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.
{
"affected": [],
"aliases": [
"CVE-2024-51800"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T14:15:21Z",
"severity": "CRITICAL"
},
"details": "Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.",
"id": "GHSA-22g3-53pr-g6hg",
"modified": "2026-04-28T21:35:33Z",
"published": "2025-04-04T15:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51800"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/homey/vulnerability/wordpress-homey-theme-2-4-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-22XP-GMQF-MRV3
Vulnerability from github – Published: 2026-08-16 03:31 – Updated: 2026-08-16 03:31A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
{
"affected": [],
"aliases": [
"CVE-2026-19928"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-16T03:16:50Z",
"severity": "LOW"
},
"details": "A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.",
"id": "GHSA-22xp-gmqf-mrv3",
"modified": "2026-08-16T03:31:06Z",
"published": "2026-08-16T03:31:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-9rrw-fx2p-p2q7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19928"
},
{
"type": "WEB",
"url": "https://github.com/OpenBoxes/OpenBoxes/pull/5948"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/commit/788cace0af816aa972a713a4631c57f16f895e6b"
},
{
"type": "WEB",
"url": "https://gist.github.com/nedlir/2bc3a6e5bd4d67b863223e1bfc2e4390"
},
{
"type": "WEB",
"url": "https://github.com/OpenBoxes/OpenBoxes"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/releases/tag/v0.9.8"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-19928"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/871981"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/390179"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/390179/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-23G5-WF5V-C68Q
Vulnerability from github – Published: 2026-08-18 09:30 – Updated: 2026-08-18 09:30A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2024-14045"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T09:16:45Z",
"severity": "LOW"
},
"details": "A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.",
"id": "GHSA-23g5-wf5v-c68q",
"modified": "2026-08-18T09:30:26Z",
"published": "2026-08-18T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-14045"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/pull/4905"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/commit/f767ac1a5987d4865d9f158c6a967680f8e45468"
},
{
"type": "WEB",
"url": "https://gist.github.com/nedlir/22cf2f1e5dd337ebba12a1be6ee83150"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes"
},
{
"type": "WEB",
"url": "https://github.com/openboxes/openboxes/releases/tag/v0.9.3"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2024-14045"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/872700"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/391109"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/391109/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-23HH-2F47-3P4H
Vulnerability from github – Published: 2026-01-20 00:30 – Updated: 2026-02-05 22:00A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "mineadmin/mineadmin"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-1193"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-05T22:00:27Z",
"nvd_published_at": "2026-01-19T23:16:03Z",
"severity": "LOW"
},
"details": "A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-23hh-2f47-3p4h",
"modified": "2026-02-05T22:00:27Z",
"published": "2026-01-20T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1193"
},
{
"type": "WEB",
"url": "https://github.com/SourByte05/MineAdmin-Vulnerability/issues/6"
},
{
"type": "PACKAGE",
"url": "https://github.com/mineadmin/MineAdmin"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.341778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.341778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.734270"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "MineAdmin has Incorrect Privilege Assignment"
}
GHSA-23MX-4W8P-JGWP
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-15 21:30Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.
{
"affected": [],
"aliases": [
"CVE-2026-39587"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T21:16:47Z",
"severity": "HIGH"
},
"details": "Unauthenticated Privilege Escalation in WP BASE Booking \u003c= 5.9.0 versions.",
"id": "GHSA-23mx-4w8p-jgwp",
"modified": "2026-06-15T21:30:45Z",
"published": "2026-06-15T21:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39587"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-5-9-0-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-242W-QMQC-XQM3
Vulnerability from github – Published: 2024-07-27 00:32 – Updated: 2024-08-01 15:32Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.
{
"affected": [],
"aliases": [
"CVE-2024-40433"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-26T22:15:03Z",
"severity": "HIGH"
},
"details": "Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.",
"id": "GHSA-242w-qmqc-xqm3",
"modified": "2024-08-01T15:32:13Z",
"published": "2024-07-27T00:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40433"
},
{
"type": "WEB",
"url": "https://github.com/yikaikkk/CookieShareInWebView/blob/master/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2468-XGPC-JVV7
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The original disclosure mentions, that "[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026."
{
"affected": [],
"aliases": [
"CVE-2026-9397"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-24T21:16:32Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The original disclosure mentions, that \"[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.\"",
"id": "GHSA-2468-xgpc-jvv7",
"modified": "2026-05-26T13:30:35Z",
"published": "2026-05-26T13:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9397"
},
{
"type": "WEB",
"url": "https://github.com/carfeii/besen#finding-4-unauthorized-firmware-installation-via-spoofed-ota-updates"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/813576"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/365378"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/365378/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2479-2FRF-9263
Vulnerability from github – Published: 2025-01-09 21:31 – Updated: 2025-01-11 00:32Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
{
"affected": [],
"aliases": [
"CVE-2024-13248"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T19:15:18Z",
"severity": "MODERATE"
},
"details": "Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.",
"id": "GHSA-2479-2frf-9263",
"modified": "2025-01-11T00:32:04Z",
"published": "2025-01-09T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13248"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2024-012"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-24R8-W5P9-R798
Vulnerability from github – Published: 2026-08-25 06:31 – Updated: 2026-08-25 06:31The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
{
"affected": [],
"aliases": [
"CVE-2026-78477"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T06:19:01Z",
"severity": "CRITICAL"
},
"details": "The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.",
"id": "GHSA-24r8-w5p9-r798",
"modified": "2026-08-25T06:31:32Z",
"published": "2026-08-25T06:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78477"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/jawn/vulnerability/wordpress-jawn-theme-1-4-2-privilege-escalation-vulnerability"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0642c85-ee01-497c-8dc3-42e3ffc02995?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.