CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
2449 vulnerabilities reference this CWE, most recent first.
GHSA-M4HG-PXFP-9FHC
Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-29 21:30Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.
{
"affected": [],
"aliases": [
"CVE-2025-67953"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-22T17:16:04Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through \u003c= 1.16.44.",
"id": "GHSA-m4hg-pxfp-9fhc",
"modified": "2026-01-29T21:30:27Z",
"published": "2026-01-22T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67953"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-16-44-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M4J4-8CHJ-8G5F
Vulnerability from github – Published: 2026-06-30 15:30 – Updated: 2026-10-22 21:32A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
{
"affected": [],
"aliases": [
"CVE-2026-4629"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T13:18:59Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.",
"id": "GHSA-m4j4-8chj-8g5f",
"modified": "2026-10-22T21:32:00Z",
"published": "2026-06-30T15:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4629"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50846"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50847"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50848"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-4629"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450244"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M4RC-HJCV-QH78
Vulnerability from github – Published: 2025-01-04 12:30 – Updated: 2025-01-04 12:30A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-0206"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-04T12:15:24Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-m4rc-hjcv-qh78",
"modified": "2025-01-04T12:30:32Z",
"published": "2025-01-04T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0206"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://gist.github.com/th4s1s/955b71b20235dddf30689d4b85b4d271"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290143"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290143"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.474033"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M52W-76VQ-GJVM
Vulnerability from github – Published: 2025-07-04 12:30 – Updated: 2026-04-01 18:35Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows Privilege Escalation. This issue affects RealHomes: from n/a through 4.4.0.
{
"affected": [],
"aliases": [
"CVE-2025-49867"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-04T12:15:32Z",
"severity": "CRITICAL"
},
"details": "Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows Privilege Escalation. This issue affects RealHomes: from n/a through 4.4.0.",
"id": "GHSA-m52w-76vq-gjvm",
"modified": "2026-04-01T18:35:45Z",
"published": "2025-07-04T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49867"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/realhomes/vulnerability/wordpress-realhomes-4-4-0-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M5MF-VC32-X88H
Vulnerability from github – Published: 2025-09-12 15:31 – Updated: 2025-09-12 15:31A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-10319"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-12T15:15:32Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-m5mf-vc32-x88h",
"modified": "2025-09-12T15:31:17Z",
"published": "2025-09-12T15:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10319"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323743"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323743"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.643839"
},
{
"type": "WEB",
"url": "https://www.cnblogs.com/aibot/p/19063358"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M5R3-634Q-M3RJ
Vulnerability from github – Published: 2026-07-26 06:31 – Updated: 2026-07-26 06:31A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.
{
"affected": [],
"aliases": [
"CVE-2026-17434"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-26T04:16:46Z",
"severity": "LOW"
},
"details": "A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.",
"id": "GHSA-m5r3-634q-m3rj",
"modified": "2026-07-26T06:31:26Z",
"published": "2026-07-26T06:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17434"
},
{
"type": "WEB",
"url": "https://github.com/nanocoai/nanoclaw/issues/2762"
},
{
"type": "WEB",
"url": "https://github.com/nanocoai/nanoclaw/pull/2998"
},
{
"type": "WEB",
"url": "https://github.com/nanocoai/nanoclaw/commit/e5b928783d5c485637565eb07d2967922dfbf8d8"
},
{
"type": "WEB",
"url": "https://github.com/nanocoai/nanoclaw"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-17434"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862451"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/383075"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/383075/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M623-J3J4-Q8VR
Vulnerability from github – Published: 2026-04-30 03:30 – Updated: 2026-04-30 03:30A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html of the component Demo Site. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-7468"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-30T01:16:03Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in 1024-lab smart-admin up to 3.30.0. This affects an unknown function of the file /smart-admin-api/druid/index.html of the component Demo Site. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-m623-j3j4-q8vr",
"modified": "2026-04-30T03:30:24Z",
"published": "2026-04-30T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7468"
},
{
"type": "WEB",
"url": "https://github.com/1024-lab/smart-admin/issues/117"
},
{
"type": "WEB",
"url": "https://github.com/1024-lab/smart-admin"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/804228"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/360204"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/360204/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M65F-9PWR-FH2G
Vulnerability from github – Published: 2025-04-14 06:30 – Updated: 2025-04-14 06:30A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-3550"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-14T04:15:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in wowjoy \u6d59\u6c5f\u6e56\u5dde\u534e\u5353\u4fe1\u606f\u79d1\u6280\u6709\u9650\u516c\u53f8 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-m65f-9pwr-fh2g",
"modified": "2025-04-14T06:30:24Z",
"published": "2025-04-14T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3550"
},
{
"type": "WEB",
"url": "https://github.com/38279/2/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304591"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304591"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.547789"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M65Q-V92H-CM7Q
Vulnerability from github – Published: 2025-06-05 01:17 – Updated: 2025-06-06 23:16Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.
This affects both:
- The supplementary groups of a user
- The group access list of the current process
If the caller uses this information for access control, this may lead to privilege escalation.
This crate is not currently maintained, so a patched version is not available.
Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.
Recommended alternatives
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "users"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.0"
},
{
"last_affected": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-5791"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-05T01:17:28Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.\n\nThis affects both:\n\n- The supplementary groups of a user\n- The group access list of the current process\n\nIf the caller uses this information for access control, this may lead to privilege escalation.\n\nThis crate is not currently maintained, so a patched version is not available.\n\nVersions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.\n\n## Recommended alternatives\n- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)\n- [`sysinfo`](https://crates.io/crates/sysinfo)",
"id": "GHSA-m65q-v92h-cm7q",
"modified": "2025-06-06T23:16:38Z",
"published": "2025-06-05T01:17:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5791"
},
{
"type": "WEB",
"url": "https://github.com/ogham/rust-users/issues/44"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-5791"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370001"
},
{
"type": "PACKAGE",
"url": "https://github.com/ogham/rust-users"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0040.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "users may append `root` to group listings"
}
GHSA-M69X-7WP8-6GJV
Vulnerability from github – Published: 2026-02-20 18:31 – Updated: 2026-02-27 18:31Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product Filter for WooCommerce: from n/a through <= 9.1.2.
{
"affected": [],
"aliases": [
"CVE-2025-69378"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-20T16:22:22Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product Filter for WooCommerce: from n/a through \u003c= 9.1.2.",
"id": "GHSA-m69x-7wp8-6gjv",
"modified": "2026-02-27T18:31:01Z",
"published": "2026-02-20T18:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69378"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/prdctfltr/vulnerability/wordpress-product-filter-for-woocommerce-plugin-9-1-2-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.