CWE-269 Improper Privilege Management
classThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (6611)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-102490US | high7.8OT critical | KEV | ||
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to… | ||||
| CVE-2026-84869US | —OT critical | KEV | ||
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circum… | ||||
| CVE-2026-46817US | —OT critical | KEV | ||
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable… | ||||
| CVE-2026-21533US | —OT critical | KEV | ||
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2024-57726US | critical9.9OT critical | KEV | ||
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be… | ||||
| CVE-2024-49035US | critical9.8OT critical | KEV | ||
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. | ||||
| CVE-2024-43093US | high7.3OT critical | KEV | ||
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicod… | ||||
| CVE-2024-8068US | high8.0OT critical | KEV | ||
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the sessi… | ||||
| CVE-2024-38014US | —OT critical | KEV | ||
Windows Installer Elevation of Privilege Vulnerability | ||||
| CVE-2024-40711US | critical9.8OT critical | KEV | ||
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). | ||||
| CVE-2024-4040US | critical10.0OT critical | KEV | ||
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the… | ||||
| CVE-2024-26169US | —OT critical | KEV | ||
Windows Error Reporting Service Elevation of Privilege Vulnerability | ||||
| CVE-2024-21338US | —OT critical | KEV | ||
Windows Kernel Elevation of Privilege Vulnerability | ||||
| CVE-2023-43208US | critical9.8OT critical | KEV | ||
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-… | ||||
| CVE-2023-20273US | high7.2OT critical | KEV | ||
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is d… | ||||
| CVE-2023-20198US | critical10.0OT critical | KEV | ||
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and… | ||||
| CVE-2023-35674US | high7.8OT critical | KEV | ||
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no… | ||||
| CVE-2023-36874US | —OT critical | KEV | ||
Windows Error Reporting Service Elevation of Privilege Vulnerability | ||||
| CVE-2023-28434US | high8.8OT critical | KEV | ||
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an obje… | ||||
| CVE-2022-27593US | critical9.1OT critical | KEV | ||
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify syst… | ||||
04
attack patterns (3)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan