CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control.

802
Total CVEs
166
Critical
546
High
8.1
Avg CVSS
1
In CISA KEV

Yearly Trend

2026
50
2025
213
2024
225
2023
118
2022
49

Top Affected Vendors

1 Microsoft 81
2 Google 46
3 Huawei 26
4 Apple 20
5 Oracle 19
6 Trendmicro 13
7 Dell 11
8 Fortinet 8
9 Apache 7
10 Citrix 7

All Improper Privilege Management CVEs (802)

CVE-2024-0003
9.1

This vulnerability allows a malicious user to exploit a remote administrative service in FlashArray Purity to create unauthorized privileged accounts ...

Sep 23, 2024
CVE-2024-7960
9.1

This CVE describes an incorrect privilege matrix vulnerability in Rockwell Automation products that allows authenticated users to access functions and...

Sep 12, 2024
CVE-2024-43121
9.1

This vulnerability in the realmag777 HUSKY WordPress plugin allows attackers to escalate privileges, potentially gaining administrative access. It aff...

Aug 13, 2024
CVE-2024-38089
9.1

This vulnerability in Microsoft Defender for IoT allows an authenticated attacker to elevate privileges to SYSTEM level on the affected device. It aff...

Jul 9, 2024
CVE-2024-25343
9.1

This vulnerability in Tenda N300 F3 routers allows attackers to bypass password policy enforcement and set weak passwords, potentially compromising ro...

Apr 26, 2024
CVE-2024-27207
9.1

This vulnerability allows malicious Android apps to bypass broadcast protection mechanisms by exploiting exported broadcast receivers. It affects Andr...

Mar 11, 2024
CVE-2024-21638
9.1

CVE-2024-21638 is an authentication bypass vulnerability in Azure IPAM that allows attackers to impersonate privileged users by manipulating authentic...

Jan 10, 2024
CVE-2023-41807
9.1

CVE-2023-41807 is an improper privilege management vulnerability in Pandora FMS that allows authenticated users to escalate their permissions to gain ...

Nov 23, 2023
CVE-2023-37917
9.1

This vulnerability in KubePi allows any authenticated user to elevate privileges to administrator by modifying the 'isadmin' parameter when creating o...

Jul 21, 2023
CVE-2023-30799
9.1

CVE-2023-30799 is a privilege escalation vulnerability in MikroTik RouterOS that allows authenticated admin users to gain super-admin privileges via W...

Jul 19, 2023
CVE-2023-25133
9.1

This CVE-2023-25133 is an improper privilege management vulnerability in PowerPanel Business software that allows remote attackers to execute operatin...

Apr 24, 2023
CVE-2021-39982
9.1

CVE-2021-39982 is an improper privilege management vulnerability in Huawei's Phone Manager application that allows attackers to read and write arbitra...

Jan 3, 2022
CVE-2020-9141
9.1

CVE-2020-9141 is an improper privilege management vulnerability in certain Huawei smartphones that allows attackers to bypass security controls due to...

Jan 13, 2021
CVE-2020-12495
9.1

This vulnerability allows privilege escalation in Endress+Hauser Ecograph T devices. When users with lower privileges log in, they may inherit higher ...

Nov 19, 2020
CVE-2024-43401
9.0

This vulnerability allows unprivileged users to trick administrators into editing malicious content in XWiki's WYSIWYG editor, executing arbitrary cod...

Aug 19, 2024
CVE-2021-23885
9.0

This CVE describes an authenticated privilege escalation vulnerability in McAfee Web Gateway (MWG) that allows authenticated users to gain elevated pr...

Feb 17, 2021
CVE-2025-8899
8.8

This vulnerability allows authenticated WordPress users with Author-level access or higher to register administrator accounts through a registration f...

Mar 7, 2026
CVE-2026-1566
8.8

This vulnerability allows authenticated attackers with Agent-level access in the LatePoint WordPress plugin to escalate privileges by linking customer...

Mar 3, 2026
CVE-2026-27899
8.8

This vulnerability allows any authenticated non-admin user in WireGuard Portal to elevate their privileges to full administrator by sending a crafted ...

Feb 26, 2026
CVE-2026-27198
8.8

This vulnerability allows authenticated users with editor roles in Formwork CMS to create new accounts with administrative privileges. It affects all ...

Feb 21, 2026
CVE-2026-0912
8.8

The Toret Manager WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to ...

Feb 19, 2026
CVE-2024-50619
8.8

CVE-2024-50619 allows authenticated low-privileged users in CIPPlanner CIPAce to escalate privileges by manipulating user IDs to access other accounts...

Feb 11, 2026
CVE-2025-15100
8.8

The JAY Login & Register WordPress plugin contains a privilege escalation vulnerability that allows authenticated users with Subscriber-level access o...

Feb 8, 2026
CVE-2025-36640
8.8

A privilege escalation vulnerability exists in the Nessus Agent Tray App installation/uninstallation process on Windows. Attackers with local access c...

Jan 13, 2026
CVE-2025-13680
8.8

The Tiger WordPress theme contains a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to elev...

Nov 27, 2025
CVE-2025-11923
8.8

The LifterLMS WordPress plugin contains a privilege escalation vulnerability that allows authenticated users with student-level access or higher to el...

Nov 13, 2025
CVE-2025-24838
8.8

This vulnerability in Intel CIP software allows unprivileged authenticated users to escalate privileges via network access without user interaction. I...

Nov 11, 2025
CVE-2025-11168
8.8

The Mementor Core WordPress plugin has a privilege escalation vulnerability that allows authenticated attackers with Subscriber-level access or higher...

Nov 11, 2025
CVE-2025-61429
8.8

This vulnerability in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges through specially crafted requests. Attac...

Oct 29, 2025
CVE-2025-11561
8.8

This vulnerability allows attackers with permission to modify Active Directory attributes (like userPrincipalName or samAccountName) to impersonate pr...

Oct 9, 2025
CVE-2025-37123
8.8

This vulnerability allows authenticated remote attackers to escalate privileges on HPE Aruba EdgeConnect SD-WAN Gateways, potentially enabling executi...

Sep 16, 2025
CVE-2025-36901
8.8

This vulnerability in Android's WLAN subsystem on Google Pixel devices allows local attackers to gain elevated privileges. Attackers could execute arb...

Sep 4, 2025
CVE-2025-6366
8.8

The Event List WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to ele...

Aug 26, 2025
CVE-2024-47853
8.8

This vulnerability allows attackers to escalate privileges when logging into Mahara using Learning Tools Interoperability (LTI). Attackers could gain ...

Aug 26, 2025
CVE-2025-57760
8.8

This privilege escalation vulnerability in Langflow allows authenticated users with RCE access to create new administrative accounts using the interna...

Aug 25, 2025
CVE-2025-6080
8.8

The WPGYM WordPress Gym Management System plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access...

Aug 16, 2025
CVE-2025-47713
8.8

A privilege escalation vulnerability in Apache CloudStack allows malicious Domain Admin users in the ROOT domain to reset passwords of Admin role acco...

Jun 10, 2025
CVE-2025-0358
8.8

This vulnerability in Axis Communications' VAPIX Device Configuration framework allows lower-privileged users to escalate their privileges to administ...

Jun 2, 2025
CVE-2025-4335
8.8

The WooCommerce Multiple Addresses plugin for WordPress has a privilege escalation vulnerability that allows authenticated users with Subscriber-level...

May 7, 2025
CVE-2025-3852
8.8

The WPshop 2 WordPress plugin allows authenticated attackers with subscriber-level access or higher to change arbitrary users' passwords, including ad...

May 7, 2025
CVE-2025-3761
8.8

This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to escalate their privileges to Administrator by exploi...

Apr 24, 2025
CVE-2025-3418
8.8

The WPC Admin Columns WordPress plugin allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to administr...

Apr 12, 2025
CVE-2025-3105
8.8

The Vehica Core WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to el...

Apr 4, 2025
CVE-2025-2858
8.8

This privilege escalation vulnerability in saTECH BCU firmware allows attackers with CLI access to bypass restrictions and gain superuser privileges u...

Mar 28, 2025
CVE-2024-13376
8.8

The Industrial WordPress theme has a privilege escalation vulnerability that allows authenticated attackers with subscriber-level access to modify Wor...

Mar 14, 2025
CVE-2025-1295
8.8

The Templines Elementor Helper Core WordPress plugin allows authenticated attackers with Subscriber-level access to escalate privileges to Administrat...

Feb 27, 2025
CVE-2024-12284
8.8

This vulnerability allows authenticated users on NetScaler Console and NetScaler Agent to escalate their privileges to higher levels than intended. At...

Feb 20, 2025
CVE-2024-57778
8.8

This vulnerability in Orbe ONetView Roeador Onet-1200 allows remote attackers to escalate privileges by manipulating server responses from status code...

Feb 14, 2025
CVE-2025-23093
8.8

This vulnerability allows authenticated attackers on Mitel OpenScape 4000 and OpenScape 4000 Manager systems to escalate privileges and execute arbitr...

Feb 6, 2025
CVE-2024-13343
8.8

The WooCommerce Customers Manager plugin for WordPress has a privilege escalation vulnerability that allows authenticated users with Subscriber-level ...

Feb 1, 2025

About Improper Privilege Management (CWE-269)

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control.

Our database tracks 802 CVEs classified as CWE-269, with 166 rated critical and 546 rated high severity. The average CVSS score for Improper Privilege Management vulnerabilities is 8.1.

External reference: View CWE-269 on MITRE CWE →

Monitor Improper Privilege Management Vulnerabilities

Get alerted when new Improper Privilege Management CVEs affect your infrastructure.

Start Monitoring Free