# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control](https://agentprime.io/advisories/CVE-2026-10255.md)
  `CVE-2026-10255` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Privilege escalation, Broken access control
- [SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization](https://agentprime.io/advisories/CVE-2026-10236.md)
  `CVE-2026-10236` · CVE record: SourceCodester Water Billing Management System · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Privilege escalation, Broken access control
- [Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier.](https://agentprime.io/advisories/CVE-2026-32325.md)
  `CVE-2026-32325` · CVE record: Fsas Technologies Inc. ServerView Agents for Windows · CVSS 8.5 High · Not analysed yet · Published 1 Jun 2026 · Tags: Privilege escalation
- [Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API](https://agentprime.io/advisories/GHSA-7fg5-vc77-69fp.md)
  `GHSA-7fg5-vc77-69fp`, `CVE-2026-10215`, `PKSA-199z-kb1w-7qjg` · Packagist `dolibarr/dolibarr`: affected `<=15.0.3`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Privilege escalation, Broken access control
- [nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization](https://agentprime.io/advisories/CVE-2026-10218.md)
  `CVE-2026-10218` · CVE record: nextlevelbuilder GoClaw · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Privilege escalation, Broken access control
- [nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management](https://agentprime.io/advisories/CVE-2026-10217.md)
  `CVE-2026-10217` · CVE record: nextlevelbuilder GoClaw · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Privilege escalation
- [Possible information disclosure via External Interface](https://agentprime.io/advisories/CVE-2026-48210.md)
  `CVE-2026-48210` · CVE record: OTRS AG OTRS · CVSS 5.7 Medium · Not analysed yet · Published 31 May 2026 · Tags: Information disclosure, Privilege escalation
- [TaleLin lin-cms-spring-boot book Endpoint BookController.java access control](https://agentprime.io/advisories/CVE-2026-10152.md)
  `CVE-2026-10152` · CVE record: TaleLin lin-cms-spring-boot · CVSS 5.3 Medium · Not analysed yet · Published 30 May 2026 · Tags: Privilege escalation, Broken access control
- [Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes](https://agentprime.io/advisories/CVE-2026-7465.md)
  `CVE-2026-7465` · CVE record: brainstormforce Spectra Gutenberg Blocks – Website Builder for the Block Editor · CVSS 8.8 High · Not analysed yet · Published 30 May 2026 · Tags: Privilege escalation
- [praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role](https://agentprime.io/advisories/GHSA-w388-2392-px73.md)
  `GHSA-w388-2392-px73`, `CVE-2026-47409`, `PYSEC-2026-2938` · PyPI `praisonai-platform`: affected `<0.1.4`, fixed in `0.1.4` · CVSS 8.1 High · Not analysed yet · Published 29 May 2026 · Tags: Privilege escalation, Broken access control
- [IPAM controller service account granted unnecessary full access to Secrets](https://agentprime.io/advisories/GHSA-49pm-43hf-6xfq.md)
  `GHSA-49pm-43hf-6xfq`, `CVE-2026-47190`, `GO-2026-5117` · Go `github.com/metal3-io/ip-address-manager`: affected `<1.11.7 || >=1.12.0, <1.12.4`, fixed in `1.11.7`, `1.12.4` · CVSS 4.4 Medium · Not analysed yet · Published 29 May 2026 · Tags: Privilege escalation
- [macrozheng mall Super Admin Password update improper authorization](https://agentprime.io/advisories/CVE-2026-10070.md)
  `CVE-2026-10070` · CVE record: macrozheng mall · CVSS 5.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: Privilege escalation, Broken access control
- [Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution](https://agentprime.io/advisories/CVE-2026-45632.md)
  `CVE-2026-45632` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Command injection, Privilege escalation, Broken access control
- [RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root](https://agentprime.io/advisories/CVE-2026-45043.md)
  `CVE-2026-45043` · CVE record: rustfs rustfs · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Privilege escalation, Broken access control
- [TFA Basic Plugins - Access Bypass](https://agentprime.io/advisories/CVE-2026-6816.md)
  `CVE-2026-6816` · CVE record: Drupal TFA Basic Plugins · CVSS 5.1 Medium · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '\_acf_post_id' Parameter](https://agentprime.io/advisories/CVE-2026-8809.md)
  `CVE-2026-8809` · CVE record: hwk-fr Advanced Custom Fields: Extended · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-9999.md)
  `CVE-2026-9999` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-9918.md)
  `CVE-2026-9918` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-9892.md)
  `CVE-2026-9892` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [OpenStack Keystone has an Incorrect Authorization issue](https://agentprime.io/advisories/GHSA-q623-f4j4-p4xj.md)
  `GHSA-q623-f4j4-p4xj`, `CVE-2026-43000`, `PYSEC-2026-601` · PyPI `keystone`: affected `>=14.0.0, <27.0.2 || >=28.0.0, <28.0.2 || >=29.0.0, <29.0.2`, fixed in `27.0.2`, `28.0.2`, `29.0.2` · CVSS 6.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Oracle Corporation Oracle Flow Manufacturing](https://agentprime.io/advisories/CVE-2026-46837.md)
  `CVE-2026-46837` · CVE record: Oracle Corporation Oracle Flow Manufacturing · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Improper access control in Oracle Corporation Oracle Payroll](https://agentprime.io/advisories/CVE-2026-46827.md)
  `CVE-2026-46827` · CVE record: Oracle Corporation Oracle Payroll · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass
- [Improper access control in Oracle Corporation Oracle Universal Work Queue](https://agentprime.io/advisories/CVE-2026-46824.md)
  `CVE-2026-46824` · CVE record: Oracle Corporation Oracle Universal Work Queue · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Payments](https://agentprime.io/advisories/CVE-2026-46817.md)
  `CVE-2026-46817` · CVE record: Oracle Corporation Oracle Payments · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.12 · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation, Authentication bypass
- [Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check](https://agentprime.io/advisories/GHSA-c9w5-qp6m-m395.md)
  `GHSA-c9w5-qp6m-m395`, `CVE-2026-9094`, `GO-2026-5953` · Go `github.com/casdoor/casdoor`: affected `<2.387.0`, fixed in `2.387.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation, Broken access control
- [Privilege Escalation](https://agentprime.io/advisories/CVE-2026-8980.md)
  `CVE-2026-8980` · CVE record: Mennekes Amtron · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection](https://agentprime.io/advisories/CVE-2026-6226.md)
  `CVE-2026-6226` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement](https://agentprime.io/advisories/GHSA-8hcx-p7m8-gc28.md)
  `GHSA-8hcx-p7m8-gc28` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 7.3 High · Withdrawn · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [NitroSense V3: Security Vulnerability Information](https://agentprime.io/advisories/CVE-2026-9789.md)
  `CVE-2026-9789` · CVE record: Acer NitrorSense V3 · CVSS 8.5 High · Not analysed yet · Published 28 May 2026 · Tags: Path traversal, Privilege escalation, Broken access control
- [Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint](https://agentprime.io/advisories/GHSA-p8jh-4p5p-2rfp.md)
  `GHSA-p8jh-4p5p-2rfp`, `CVE-2026-48926` · Maven `org.jenkins-ci.plugins:job-import-plugin`: affected `<143.145.v48f9a`, fixed in `143.145.v48f9a` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation](https://agentprime.io/advisories/GHSA-9wm7-8qf3-9v98.md)
  `GHSA-9wm7-8qf3-9v98`, `CVE-2026-48923` · Maven `com.rapid7:jenkinsci-appspider-plugin`: affected `<1.0.18`, fixed in `1.0.18` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [Vulnerabilities exists in IBM Netezza Performance Server Replication Services](https://agentprime.io/advisories/CVE-2026-3623.md)
  `CVE-2026-3623` · CVE record: IBM Netezza Performance Server Replication Services · CVSS 7.8 High · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-42758.md)
  `CVE-2026-42758` · CVE record: Saleswonder Team: Tobias WebinarIgnition · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-42731.md)
  `CVE-2026-42731` · CVE record: miniOrange miniorange otp verification · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation](https://agentprime.io/advisories/CVE-2026-8787.md)
  `CVE-2026-8787` · CVE record: devsabbirahmed Firebase Support & Chat Management · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.](https://agentprime.io/advisories/CVE-2026-33552.md)
  `CVE-2026-33552` · CVE record · CVSS 3.7 Low · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [JeecgBoot AiragModelController access control](https://agentprime.io/advisories/CVE-2026-9604.md)
  `CVE-2026-9604` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2025-43306.md)
  `CVE-2025-43306` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation
- [JeecgBoot add access control](https://agentprime.io/advisories/CVE-2026-9581.md)
  `CVE-2026-9581` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, Broken access control
- [JeecgBoot selectDepart LoginController.selectDepart access control](https://agentprime.io/advisories/CVE-2026-9580.md)
  `CVE-2026-9580` · CVE record: JeecgBoot · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, Broken access control
- [JeecgBoot SysUser userEdit user.getUsername access control](https://agentprime.io/advisories/CVE-2026-9579.md)
  `CVE-2026-9579` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, Broken access control
- [OS command injection in OpenVPN Inc OpenVPN Connect](https://agentprime.io/advisories/CVE-2026-9560.md)
  `CVE-2026-9560` · CVE record: OpenVPN Inc OpenVPN Connect · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Command injection, Privilege escalation, CWE-648
- [sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control](https://agentprime.io/advisories/CVE-2026-9562.md)
  `CVE-2026-9562` · CVE record: sambitraj STUDENT-MANAGEMENT-SYSTEM · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, Broken access control
- [hermes-agent has a sandbox issue](https://agentprime.io/advisories/GHSA-wm96-9gfh-vvgq.md)
  `GHSA-wm96-9gfh-vvgq`, `CVE-2026-9368`, `PYSEC-2026-2515` · PyPI `hermes-agent`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, CWE-264, CWE-265, CWE-526
- [hemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control](https://agentprime.io/advisories/CVE-2026-9517.md)
  `CVE-2026-9517` · CVE record: hemant6488 CodeIgniter-StudentManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Privilege escalation, Broken access control
- [WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-45216.md)
  `CVE-2026-45216` · CVE record: StoreApps Smart Manager · CVSS 8.8 High · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation
- [SourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorization](https://agentprime.io/advisories/CVE-2026-9484.md)
  `CVE-2026-9484` · CVE record: SourceCodester Student Grades Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation, Broken access control
- [SourceCodester Student Grades Management System grades.php improper authorization](https://agentprime.io/advisories/CVE-2026-9483.md)
  `CVE-2026-9483` · CVE record: SourceCodester Student Grades Management System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation, Broken access control
- [Acer Care Center creates a Named Pipe with a weak Security Descriptor](https://agentprime.io/advisories/CVE-2026-9490.md)
  `CVE-2026-9490` · CVE record: Acer Care Center · CVSS 6.8 Medium · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation
- [NitroSense V3: Local Privilege Escalation (LPE) vulnerability](https://agentprime.io/advisories/CVE-2026-9489.md)
  `CVE-2026-9489` · CVE record: Acer NitrorSense V3 · CVSS 8.5 High · Not analysed yet · Published 25 May 2026 · Tags: Path traversal, Privilege escalation, Broken access control
- [SourceCodester Indian Invoicing System Backend Endpoint access control](https://agentprime.io/advisories/CVE-2026-9412.md)
  `CVE-2026-9412` · CVE record: SourceCodester Indian Invoicing System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation, Broken access control
- [Sushmi-pal Invoice-System Profile Workflow profile improper authorization](https://agentprime.io/advisories/CVE-2026-9410.md)
  `CVE-2026-9410` · CVE record: Sushmi-pal Invoice-System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation, Broken access control
- [Sushmi-pal Invoice-System User Management user improper authorization](https://agentprime.io/advisories/CVE-2026-9409.md)
  `CVE-2026-9409` · CVE record: Sushmi-pal Invoice-System · CVSS 5.3 Medium · Not analysed yet · Published 25 May 2026 · Tags: Privilege escalation, Broken access control
- [Besen BS20 EV Charging Station OTA Update Installation improper authorization](https://agentprime.io/advisories/CVE-2026-9397.md)
  `CVE-2026-9397` · CVE record: Besen BS20 EV Charging Station · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2026 · Tags: Privilege escalation, Broken access control
- [JPress UCenter Article Submission Endpoint doWriteSave improper authorization](https://agentprime.io/advisories/CVE-2026-9376.md)
  `CVE-2026-9376` · CVE record: JPress · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2026 · Tags: Privilege escalation, Broken access control
- [Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action](https://agentprime.io/advisories/CVE-2026-6419.md)
  `CVE-2026-6419` · CVE record: Wishlist Member Wishlist Member · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: Privilege escalation
- [Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action](https://agentprime.io/advisories/CVE-2026-6897.md)
  `CVE-2026-6897` · CVE record: Wishlist Member Wishlist Member · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: Privilege escalation
- [Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action](https://agentprime.io/advisories/CVE-2026-6895.md)
  `CVE-2026-6895` · CVE record: Wishlist Member Wishlist Member · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: Privilege escalation
- [WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action](https://agentprime.io/advisories/CVE-2026-6898.md)
  `CVE-2026-6898` · CVE record: Wishlist Member Wishlist Member · CVSS 8.8 High · Not analysed yet · Published 23 May 2026 · Tags: Privilege escalation
- [Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron](https://agentprime.io/advisories/GHSA-99gv-2m7h-3hh9.md)
  `GHSA-99gv-2m7h-3hh9`, `CVE-2026-46716`, `GO-2026-5282` · Go `github.com/nezhahq/nezha`: affected `>=1.4.0, <1.14.15-0.20260517022419-d7526351cf97`, fixed in `1.14.15-0.20260517022419-d7526351cf97` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2026 · Tags: Command injection, Privilege escalation, Broken access control

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA1LTIzVDAwOjE3OjU4LjAwMDAwMFoiLCJHSFNBLTk5Z3YtMm03aC0zaGg5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTA2LTAxVDE0OjIzOjA4LjAwMDAwMFoiLCJHSFNBLXJjbWMtcTlyai00d21xIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTA2LTAxVDE0OjIzOjA4LjAwMDAwMFoiLCJHSFNBLXJjbWMtcTlyai00d21xIl0>. Everything for agents: <https://agentprime.io/llms.txt>.