# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)](https://agentprime.io/advisories/CVE-2026-100363.md)
  `CVE-2026-100363` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints](https://agentprime.io/advisories/CVE-2026-77439.md)
  `CVE-2026-77439` · CVE record: immich-app immich · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders](https://agentprime.io/advisories/CVE-2026-114233.md)
  `CVE-2026-114233` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter](https://agentprime.io/advisories/CVE-2026-95652.md)
  `CVE-2026-95652` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter · CVSS 6.6 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter](https://agentprime.io/advisories/CVE-2026-118193.md)
  `CVE-2026-118193` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy](https://agentprime.io/advisories/CVE-2026-122313.md)
  `CVE-2026-122313` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String](https://agentprime.io/advisories/CVE-2026-122312.md)
  `CVE-2026-122312` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check](https://agentprime.io/advisories/CVE-2026-122302.md)
  `CVE-2026-122302` · CVE record: kyverno kyverno · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [InvoiceShelf MemberService.php create access control](https://agentprime.io/advisories/CVE-2026-122158.md)
  `CVE-2026-122158` · CVE record: InvoiceShelf · CVSS 5.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Incorrect privilege assignment issue exists in Hinemos.](https://agentprime.io/advisories/CVE-2026-109849.md)
  `CVE-2026-109849` · CVE record: NTT DATA INTELLILINK Corporation Hinemos · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access](https://agentprime.io/advisories/CVE-2026-54382.md)
  `CVE-2026-54382` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Privilege escalation
- [yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management](https://agentprime.io/advisories/CVE-2026-122016.md)
  `CVE-2026-122016` · CVE record: yangzongzhuan RuoYi-Vue · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Privilege escalation
- [WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-119481.md)
  `CVE-2026-119481` · CVE record: Crocoblock JetFormBuilder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Privilege escalation
- [WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-65555.md)
  `CVE-2026-65555` · CVE record: Uncanny Owl Uncanny Toolkit for LearnDash · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Privilege escalation
- [Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters](https://agentprime.io/advisories/CVE-2026-104799.md)
  `CVE-2026-104799` · CVE record: rnlab Mobile builder · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Privilege escalation
- [Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server](https://agentprime.io/advisories/CVE-2025-11229.md)
  `CVE-2025-11229` · CVE record: WSO2 WSO2 Identity Server and 1 more · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Privilege escalation
- [miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control](https://agentprime.io/advisories/CVE-2026-121539.md)
  `CVE-2026-121539` · CVE record: miroslavpejic85 MiroTalk P2P · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation, Broken access control
- [EasySoft ZenTao PMS User model.php checkGroupChange privileges management](https://agentprime.io/advisories/CVE-2026-121514.md)
  `CVE-2026-121514` · CVE record: EasySoft ZenTao PMS · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in Google Chrome](https://agentprime.io/advisories/CVE-2026-121234.md)
  `CVE-2026-121234` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in Google Chrome](https://agentprime.io/advisories/CVE-2026-121196.md)
  `CVE-2026-121196` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-121090.md)
  `CVE-2026-121090` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [Babelfish for PostgreSQL Privilege Escalation](https://agentprime.io/advisories/CVE-2026-119922.md)
  `CVE-2026-119922` · CVE record: AWS babelfish-for-postgresql · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning](https://agentprime.io/advisories/CVE-2026-121559.md)
  `CVE-2026-121559` · CVE record: glpi-project GLPI · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision](https://agentprime.io/advisories/CVE-2026-121419.md)
  `CVE-2026-121419` · CVE record: surrealdb surrealdb · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation
- [User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege](https://agentprime.io/advisories/CVE-2026-115231.md)
  `CVE-2026-115231` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 8.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-58974.md)
  `CVE-2026-58974` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-58962.md)
  `CVE-2026-58962` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-91893.md)
  `CVE-2026-91893` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 7.8 High · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller](https://agentprime.io/advisories/CVE-2026-94290.md)
  `CVE-2026-94290` · CVE record: SUSE Rancher · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [Apache Syncope: AuthProfile value escalation via self-service update](https://agentprime.io/advisories/CVE-2026-110535.md)
  `CVE-2026-110535` · CVE record: Apache Software Foundation Apache Syncope · No CVSS score · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [Prefab UI Pyodide sandbox escape to host RCE](https://agentprime.io/advisories/CVE-2026-120338.md)
  `CVE-2026-120338` · CVE record: PrefectHQ prefab-ui · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Code injection, Privilege escalation, CWE-693
- [Beta9 build sandbox escape via chroot-only isolation](https://agentprime.io/advisories/CVE-2026-120306.md)
  `CVE-2026-120306` · CVE record: beam-cloud Beta9 worker · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Privilege escalation, CWE-653
- [Oray Pugongying X5 Pro API Authorization run_async_task improper authorization](https://agentprime.io/advisories/CVE-2026-120224.md)
  `CVE-2026-120224` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Privilege escalation, Broken access control
- [ken678 YznCMS Auth Group Group.php Backend privileges management](https://agentprime.io/advisories/CVE-2026-120185.md)
  `CVE-2026-120185` · CVE record: ken678 YznCMS · CVSS 5.1 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Privilege escalation
- [User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter](https://agentprime.io/advisories/CVE-2026-120070.md)
  `CVE-2026-120070` · CVE record: wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission · CVSS 8.8 High · Not analysed yet · Published 31 Oct 2026 · Tags: Privilege escalation
- [Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint](https://agentprime.io/advisories/CVE-2026-104012.md)
  `CVE-2026-104012` · CVE record: roxnor Rox Appointment Booking – Event, Calendar & Appointment Scheduling · CVSS 8.8 High · Not analysed yet · Published 31 Oct 2026 · Tags: Privilege escalation
- [Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure](https://agentprime.io/advisories/CVE-2026-120040.md)
  `CVE-2026-120040` · CVE record: wardee Mail logging & Catcher · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2026 · Tags: Privilege escalation
- [Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_role](https://agentprime.io/advisories/CVE-2026-110808.md)
  `CVE-2026-110808` · CVE record: Unknown Essential Addons for Elementor · CVSS 4.2 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Privilege escalation
- [IXP Manager has authenticated non-administrator privilege escalation](https://agentprime.io/advisories/CVE-2026-63339.md)
  `CVE-2026-63339` · CVE record: inex IXP-Manager · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation, CWE-20
- [Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation](https://agentprime.io/advisories/CVE-2026-62990.md)
  `CVE-2026-62990` · CVE record: shopperlabs shopper · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS), Privilege escalation
- [NovumOS: Nova Interpreter Privilege Escalation](https://agentprime.io/advisories/CVE-2026-40573.md)
  `CVE-2026-40573` · CVE record: MinecAnton209 NovumOS · CVSS 8.6 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [Kargo: Privilege escalation via Project RBAC management in the Kargo API](https://agentprime.io/advisories/CVE-2026-61850.md)
  `CVE-2026-61850` · CVE record: akuity kargo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-118086.md)
  `CVE-2026-118086` · CVE record: Hakan Ozevin WP BASE Booking · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-116386.md)
  `CVE-2026-116386` · CVE record: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-54854.md)
  `CVE-2026-54854` · CVE record: Cozmoslabs Profile Builder · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update](https://agentprime.io/advisories/CVE-2026-105894.md)
  `CVE-2026-105894` · CVE record: akbilisim Ak Framework · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision](https://agentprime.io/advisories/CVE-2026-118205.md)
  `CVE-2026-118205` · CVE record: wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets · CVSS 7.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes](https://agentprime.io/advisories/CVE-2026-119599.md)
  `CVE-2026-119599` · CVE record: looplj AxonHub · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-101213.md)
  `CVE-2026-101213` · CVE record: Dell OpenManage Enterprise · CVSS 7.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [Credential exposure to space supporter](https://agentprime.io/advisories/CVE-2026-59386.md)
  `CVE-2026-59386` · CVE record: Cloud Foundry Cloud Foundry Controller (CAPI) and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225](https://agentprime.io/advisories/CVE-2026-114524.md)
  `CVE-2026-114524` · CVE record: Drupal Custom Formatters · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-118082.md)
  `CVE-2026-118082` · CVE record: BuddyBoss Buddyboss Platform · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Privilege escalation
- [LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset](https://agentprime.io/advisories/CVE-2026-113616.md)
  `CVE-2026-113616` · CVE record: Unknown LogixFast Auth · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Privilege escalation
- [n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance](https://agentprime.io/advisories/CVE-2026-118644.md)
  `CVE-2026-118644` · CVE record: n8n-io n8n · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86393.md)
  `CVE-2026-86393` · CVE record: Dell PowerProtect Data Domain · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Privilege escalation
- [BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation](https://agentprime.io/advisories/CVE-2026-76780.md)
  `CVE-2026-76780` · CVE record: rankingcoach BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Privilege escalation
- [Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter](https://agentprime.io/advisories/CVE-2026-109381.md)
  `CVE-2026-109381` · CVE record: magepeopleteam Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Privilege escalation
- [GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings](https://agentprime.io/advisories/CVE-2026-111577.md)
  `CVE-2026-111577` · CVE record: Unknown GoSMTP · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Privilege escalation
- [Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401](https://agentprime.io/advisories/CVE-2026-58255.md)
  `CVE-2026-58255` · CVE record: jhuckaby Cronicle · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes](https://agentprime.io/advisories/CVE-2026-57202.md)
  `CVE-2026-57202` · CVE record: asterisk asterisk and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, CWE-1220

Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTEwLTI3VDE3OjU4OjQ2LjI1NzAwMFoiLCJDVkUtMjAyNi01NzIwMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/>. Everything for agents: <https://agentprime.io/llms.txt>.