# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-23663.md)
  `CVE-2026-23663` · CVE record: Microsoft Microsoft Global Secure Access (GSA) · CVSS 7.5 High · Not analysed yet · Published 22 May 2026 · Tags: Privilege escalation
- [authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser](https://agentprime.io/advisories/CVE-2026-40172.md)
  `CVE-2026-40172` · CVE record: goauthentik authentik · CVSS 8.1 High · Not analysed yet · Published 22 May 2026 · Tags: Privilege escalation
- [Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability.](https://agentprime.io/advisories/CVE-2025-32747.md)
  `CVE-2025-32747` · CVE record: Dell PowerFlex Manager (Appliance) and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2026 · Tags: Privilege escalation
- [Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter](https://agentprime.io/advisories/CVE-2026-9018.md)
  `CVE-2026-9018` · CVE record: themewant Easy Elements for Elementor – Addons & Website Templates · CVSS 8.8 High · Not analysed yet · Published 22 May 2026 · Tags: Privilege escalation
- [Concrete CMS has a session-hardening bypass and allows password change without reauthorization](https://agentprime.io/advisories/GHSA-wmw3-3fv3-h54w.md)
  `GHSA-wmw3-3fv3-h54w`, `CVE-2026-8327`, `PKSA-5dbv-8tcv-hjg5` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2026 · Tags: Privilege escalation, Broken access control, CWE-620
- [containerd user ID handling bypass allows runAsNonRoot evasion](https://agentprime.io/advisories/GHSA-fqw6-gf59-qr4w.md)
  `GHSA-fqw6-gf59-qr4w`, `CVE-2026-46680`, `GO-2026-5378` · Go `github.com/containerd/containerd` and 1 more: affected `>=1.7.27, <1.7.32`, fixed in `1.7.32` · CVSS 7.3 High · Not analysed yet · Published 21 May 2026 · Tags: Privilege escalation, Memory corruption
- [@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies](https://agentprime.io/advisories/GHSA-4xrh-5m3m-328w.md)
  `GHSA-4xrh-5m3m-328w`, `CVE-2026-82860` · npm `@hulumi/policies`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Privilege escalation
- [Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables](https://agentprime.io/advisories/GHSA-7pjr-qpvh-m339.md)
  `GHSA-7pjr-qpvh-m339`, `CVE-2026-46618`, `GO-2026-5230` · Go `github.com/fission/fission`: affected `<1.23.0`, fixed in `1.23.0` · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: Command injection, Privilege escalation
- [Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read](https://agentprime.io/advisories/GHSA-85g2-pmrx-r49q.md)
  `GHSA-85g2-pmrx-r49q`, `CVE-2026-46617`, `GO-2026-5241` · Go `github.com/fission/fission`: affected `<1.23.0`, fixed in `1.23.0` · CVSS 8.7 High · Not analysed yet · Published 21 May 2026 · Tags: Privilege escalation, Information disclosure
- [Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'](https://agentprime.io/advisories/CVE-2026-5118.md)
  `CVE-2026-5118` · CVE record: Divi Engine Divi Form Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Privilege escalation
- [Incorrect libcap_net limitation list manipulation](https://agentprime.io/advisories/CVE-2026-45254.md)
  `CVE-2026-45254` · CVE record: FreeBSD FreeBSD · CVSS 6.5 Medium · Not analysed yet · Published 21 May 2026 · Tags: Privilege escalation
- [LiteSpeed Technologies cPanel Plugin: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to…](https://agentprime.io/advisories/CVE-2026-48172.md)
  `CVE-2026-48172` · CVE record: LiteSpeed Technologies cPanel Plugin and 1 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.18 · Not analysed yet · Published 21 May 2026 · Tags: Privilege escalation
- [phpMyFAQ: IDOR Account Takeover](https://agentprime.io/advisories/GHSA-xvp4-phqj-cjr3.md)
  `GHSA-xvp4-phqj-cjr3`, `CVE-2026-35671`, `PKSA-ttcw-fg74-jv2w`, `PKSA-vdjw-v652-d3d9` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.3`, fixed in `4.1.3` · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: Privilege escalation, Broken access control
- [Read More & Accordion <= 3.5.7 - Privilege Escalation via importData](https://agentprime.io/advisories/CVE-2026-7467.md)
  `CVE-2026-7467` · CVE record: edmonparker Read More & Accordion · CVSS 8.8 High · Not analysed yet · Published 20 May 2026 · Tags: Privilege escalation
- [Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register](https://agentprime.io/advisories/CVE-2026-7284.md)
  `CVE-2026-7284` · CVE record: themewant Easy Elements for Elementor – Addons & Website Templates · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2026 · Tags: Privilege escalation
- [Automic Automation Agent Unix privilege escalation](https://agentprime.io/advisories/CVE-2026-8370.md)
  `CVE-2026-8370` · CVE record: Broadcom Automic Automation · CVSS 8.5 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour](https://agentprime.io/advisories/GHSA-6vp2-6r7m-2jvx.md)
  `GHSA-6vp2-6r7m-2jvx`, `CVE-2026-46424` · npm `@budibase/backend-core`: affected `<3.38.2`, fixed in `3.38.2` · CVSS 4.2 Medium · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Privilege escalation in the WebRTC: Audio/Video component](https://agentprime.io/advisories/CVE-2026-8972.md)
  `CVE-2026-8972` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Privilege escalation in the Security component](https://agentprime.io/advisories/CVE-2026-8970.md)
  `CVE-2026-8970` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Privilege escalation in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-8957.md)
  `CVE-2026-8957` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Privilege escalation in the DOM: Workers component](https://agentprime.io/advisories/CVE-2026-8955.md)
  `CVE-2026-8955` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Privilege escalation in the Application Update component](https://agentprime.io/advisories/CVE-2026-8952.md)
  `CVE-2026-8952` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer](https://agentprime.io/advisories/CVE-2026-32323.md)
  `CVE-2026-32323` · CVE record: mullvad mullvadvpn-app · CVSS 7.3 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation, CWE-345, CWE-427
- [The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration.](https://agentprime.io/advisories/CVE-2026-31070.md)
  `CVE-2026-31070` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation
- [Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration](https://agentprime.io/advisories/GHSA-c54j-xp92-wh28.md)
  `GHSA-c54j-xp92-wh28`, `CVE-2026-45716` · npm `@budibase/worker`: affected `<3.38.1`, fixed in `3.38.1` · CVSS 8.8 High · Not analysed yet · Published 18 May 2026 · Tags: Privilege escalation
- [Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with limited access privileges to gain unauthorized administrato…](https://agentprime.io/advisories/CVE-2026-41085.md)
  `CVE-2026-41085` · CVE record · CVSS 8.8 High · Not analysed yet · Published 18 May 2026 · Tags: Privilege escalation
- [h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control](https://agentprime.io/advisories/CVE-2026-8752.md)
  `CVE-2026-8752` · CVE record: h2oai h2o-3 · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: Privilege escalation, Broken access control
- [Z-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization](https://agentprime.io/advisories/CVE-2026-8747.md)
  `CVE-2026-8747` · CVE record: Z-BlogPHP · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2026 · Tags: Privilege escalation, Broken access control
- [Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization](https://agentprime.io/advisories/CVE-2026-8743.md)
  `CVE-2026-8743` · CVE record: Open5GS · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2026 · Tags: Privilege escalation, Broken access control
- [AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token](https://agentprime.io/advisories/CVE-2026-8719.md)
  `CVE-2026-8719` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 8.8 High · Not analysed yet · Published 17 May 2026 · Tags: Privilege escalation
- [ptrace: slightly saner 'get_dumpable()' logic](https://agentprime.io/advisories/CVE-2026-46333.md)
  `CVE-2026-46333` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 15 May 2026 · Tags: Privilege escalation
- [Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form](https://agentprime.io/advisories/CVE-2026-6228.md)
  `CVE-2026-6228` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 8.8 High · Not analysed yet · Published 15 May 2026 · Tags: Privilege escalation
- [Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts](https://agentprime.io/advisories/GHSA-h3ww-q6xx-w7x3.md)
  `GHSA-h3ww-q6xx-w7x3`, `CVE-2026-45675`, `PYSEC-2026-2730` · PyPI `open-webui`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 8.1 High · Not analysed yet · Published 14 May 2026 · Tags: Privilege escalation, Race condition
- [Open WebUI: Missing \`workspace.tools\` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution](https://agentprime.io/advisories/GHSA-p4fx-23fq-jfg6.md)
  `GHSA-p4fx-23fq-jfg6`, `CVE-2026-45395` · npm `open-webui`: affected `<0.9.5`, fixed in `0.9.5` · CVSS 7.2 High · Not analysed yet · Published 14 May 2026 · Tags: Privilege escalation, Broken access control
- [wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager](https://agentprime.io/advisories/GHSA-9qpr-vc49-hqg2.md)
  `GHSA-9qpr-vc49-hqg2`, `CVE-2026-43978`, `PYSEC-2026-3420` · PyPI `wger`: affected `<=2.5`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 14 May 2026 · Tags: Privilege escalation
- [Improper privilege management in AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics and others](https://agentprime.io/advisories/CVE-2025-62625.md)
  `CVE-2025-62625` · CVE record: AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics and 4 more · CVSS 6.0 Medium · Not analysed yet · Published 14 May 2026 · Tags: Privilege escalation
- [Privilege Escalation in Comarch ERP Optima](https://agentprime.io/advisories/CVE-2025-68420.md)
  `CVE-2025-68420` · CVE record: Comarch ERP Optima · CVSS 7.5 High · Not analysed yet · Published 14 May 2026 · Tags: Privilege escalation
- [Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user](https://agentprime.io/advisories/CVE-2026-5193.md)
  `CVE-2026-5193` · CVE record: wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in WebPros cPanel and others](https://agentprime.io/advisories/CVE-2026-29205.md)
  `CVE-2026-29205` · CVE record: WebPros cPanel and 1 more · CVSS 8.6 High · Not analysed yet · Published 13 May 2026 · Tags: Privilege escalation
- [Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService](https://agentprime.io/advisories/CVE-2026-44470.md)
  `CVE-2026-44470` · CVE record: anthropics claude-code · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Path traversal, Privilege escalation
- [BIG-IP and BIG-IQ privilege escalation vulnerability](https://agentprime.io/advisories/CVE-2026-42406.md)
  `CVE-2026-42406` · CVE record: F5 BIG-IP and 1 more · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Privilege escalation
- [BIG-IP and BIG-IQ privilege escalation vulnerability](https://agentprime.io/advisories/CVE-2026-32643.md)
  `CVE-2026-32643` · CVE record: F5 BIG-IP and 1 more · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Privilege escalation
- [BIG-IP scripted monitor vulnerability](https://agentprime.io/advisories/CVE-2026-32673.md)
  `CVE-2026-32673` · CVE record: F5 BIG-IP · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: Privilege escalation
- [iControl SOAP vulnerability](https://agentprime.io/advisories/CVE-2026-35062.md)
  `CVE-2026-35062` · CVE record: F5 BIG-IP · CVSS 7.1 High · Not analysed yet · Published 13 May 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in KDE plasma-login-manager](https://agentprime.io/advisories/CVE-2026-25710.md)
  `CVE-2026-25710` · CVE record: KDE plasma-login-manager · CVSS 7.0 High · Not analysed yet · Published 13 May 2026 · Tags: Privilege escalation
- [ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation](https://agentprime.io/advisories/CVE-2026-42289.md)
  `CVE-2026-42289` · CVE record: ChurchCRM CRM · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Privilege escalation, Authentication bypass, Cross-site request forgery (CSRF)
- [Wiki.js: Privilege Escalation via Missing Group Validation in users.update](https://agentprime.io/advisories/CVE-2026-44224.md)
  `CVE-2026-44224` · CVE record: requarks wiki · CVSS 8.6 High · Not analysed yet · Published 12 May 2026 · Tags: Privilege escalation
- [Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-33821.md)
  `CVE-2026-33821` · CVE record: Microsoft Dynamics 365 · CVSS 7.7 High · Not analysed yet · Published 12 May 2026 · Tags: Privilege escalation
- [Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-42833.md)
  `CVE-2026-42833` · CVE record: Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in Dell PowerScale InsightIQ](https://agentprime.io/advisories/CVE-2026-40638.md)
  `CVE-2026-40638` · CVE record: Dell PowerScale InsightIQ · CVSS 6.7 Medium · Not analysed yet · Published 12 May 2026 · Tags: Privilege escalation
- [Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access](https://agentprime.io/advisories/CVE-2026-43886.md)
  `CVE-2026-43886` · CVE record: outline outline · CVSS 8.2 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation
- [Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks](https://agentprime.io/advisories/CVE-2026-41489.md)
  `CVE-2026-41489` · CVE record: pi-hole pi-hole · CVSS 8.8 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation, Broken access control, CWE-15
- [Information disclosure in Apple macOS](https://agentprime.io/advisories/CVE-2026-28976.md)
  `CVE-2026-28976` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure, Privilege escalation
- [Improper privilege management in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-28995.md)
  `CVE-2026-28995` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 8.8 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation
- [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2026-28840.md)
  `CVE-2026-28840` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation
- [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2026-28919.md)
  `CVE-2026-28919` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation
- [Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints](https://agentprime.io/advisories/GHSA-w626-296m-8f85.md)
  `GHSA-w626-296m-8f85` · npm `openclaw`: affected `<2026.4.22`, fixed in `2026.4.22` · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation
- [Local Path Provisioner Vulnerable to HelperPod Template Injection](https://agentprime.io/advisories/GHSA-7fxv-8wr2-mfc4.md)
  `GHSA-7fxv-8wr2-mfc4`, `CVE-2026-44543`, `GO-2026-5218` · Go `github.com/rancher/local-path-provisioner`: affected `<0.0.36`, fixed in `0.0.36` · CVSS 8.7 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation, Code injection
- [CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE](https://agentprime.io/advisories/GHSA-423p-g724-fr39.md)
  `GHSA-423p-g724-fr39`, `CVE-2026-44477`, `GO-2026-5106` · Go `github.com/cloudnative-pg/cloudnative-pg`: affected `<1.28.3 || >=1.29.0, <1.29.1`, fixed in `1.28.3`, `1.29.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation, CWE-271, CWE-426
- [Improper privilege management in Dell ECS and others](https://agentprime.io/advisories/CVE-2026-26946.md)
  `CVE-2026-26946` · CVE record: Dell ECS and 1 more · CVSS 6.7 Medium · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA1LTExVDA5OjM5OjIyLjE3NzAwMFoiLCJDVkUtMjAyNi0yNjk0NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTA1LTIzVDAwOjE3OjU4LjAwMDAwMFoiLCJHSFNBLTk5Z3YtMm03aC0zaGg5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTA1LTIzVDAwOjE3OjU4LjAwMDAwMFoiLCJHSFNBLTk5Z3YtMm03aC0zaGg5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.