Incorrect Privilege Assignment
CWE-266
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
We track 586 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Latest Incorrect Privilege Assignment vulnerabilities
- 7.3 High severity
Consul: Incorrect Privilege Assignment
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
- 7.7 High severity
Terraform Enterprise: Incorrect Authorization
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate,
- 7.8 High severity
Spectrum Protect Backup-Archive Client: Incorrect Privilege Assignment
IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.
- 9.8 Critical severity
minikube: Incorrect Privilege Assignment
This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container.
- 8.8 High severity
WP Data Access – App Builder for Tables…: Incorrect Privilege Assignment
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it possible for authenticated attackers, with
- 7.8 High severity
Android: Incorrect Privilege Assignment
In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo
- 8.8 High severity
Hitachi Storage Plug-in for VMware vCenter: Improper Privilege Management
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1.
- 8.8 High severity
Hitachi Storage Plug-in for VMware vCenter: Improper Privilege Management
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1.
- 8.8 High severity
Facepay: Improper Privilege Management
A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognition-php/facepay-master/camera.php. The manipulation of the argument userId leads to authorization byp
- 7.5 High severity
Smart Campus System: Incorrect Privilege Assignment
A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of the file /services/Card/findUser. The manipulation leads to information disclosure. The attack may be
- 9.8 Critical severity
House Rental System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestrict
- 9.8 Critical severity
Human Resource Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulatio
- 9.8 Critical severity
wms: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The att
- 9.8 Critical severity
Event Registration System: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB-
- 8.8 High severity
ERP: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation leads
- 9.8 Critical severity
CMS: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initi
- 8.8 High severity
CMS: Incorrect Privilege Assignment
A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The expl
- 9.8 Critical severity
Ehoney: Incorrect Privilege Assignment
A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerabil
- 7.2 High severity
Simple Cold Storage Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation
- 8.8 High severity
Human Resource Management System: Incorrect Privilege Assignment
A vulnerability was found in SourceCodester Human Resource Management System 1.0 and classified as critical. This issue affects some unknown processing of the file employeeadd.php of the component Admin Panel. The manipulation leads to improper access controls
- 9.8 Critical severity
Human Resource Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler. The manipulation lea
- 7.5 High severity
Web-Based Student Clearance System: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Photo Handler. The manipulation leads to unrestric
- 8.8 High severity
Hitachi Storage Plug-in for VMware vCenter: Improper Privilege Management
Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.0.
- 7.6 High severity
ImageCast X application: Incorrect Authorization
The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain
- 8.8 High severity
Cisco Adaptive Security Appliance (ASA) Software: Improper Privilege Management
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privil
- 7.8 High severity
Cisco IOS XE Software: Incorrect Privilege Assignment
A vulnerability in the CLI of Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an authenticated, local attacker to elevate privileges to level 15 on an affected device. This vulnerabi