# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [TDengine: Standard User permission unexpect](https://agentprime.io/advisories/CVE-2026-62355.md)
  `CVE-2026-62355` · CVE record: taosdata TDengine · CVSS 5.4 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation
- [CVE-2026-14961](https://agentprime.io/advisories/CVE-2026-14961.md)
  `CVE-2026-14961` · CVE record: Pegatron Corp. Tdelo64.sys · CVSS 6.2 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation, CWE-20
- [CVE-2026-14960](https://agentprime.io/advisories/CVE-2026-14960.md)
  `CVE-2026-14960` · CVE record: Pegatron Corp. Tdelo64.sys · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation, Broken access control, Information disclosure
- [FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows](https://agentprime.io/advisories/CVE-2026-50562.md)
  `CVE-2026-50562` · CVE record: labring FastGPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation, CWE-494, CWE-829
- [phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint](https://agentprime.io/advisories/CVE-2026-57996.md)
  `CVE-2026-57996` · CVE record: phpMyFAQ phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell PowerScale OneFS](https://agentprime.io/advisories/CVE-2026-49501.md)
  `CVE-2026-49501` · CVE record: Dell PowerScale OneFS · CVSS 6.7 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation
- [Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend](https://agentprime.io/advisories/GHSA-qf34-295c-26v8.md)
  `GHSA-qf34-295c-26v8`, `CVE-2026-61549`, `GO-2026-5992` · Go `github.com/woodpecker-ci/woodpecker` and 2 more: affected `>=1.0.0, <=1.0.4`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Windows Group Policy Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-50391.md)
  `CVE-2026-50391` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Privilege escalation
- [Microsoft Install Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-50343.md)
  `CVE-2026-50343` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Privilege escalation
- [Windows Zero Trust DNS Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-50295.md)
  `CVE-2026-50295` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Privilege escalation
- [Windows WalletService Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-49176.md)
  `CVE-2026-49176` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Path traversal, Privilege escalation
- [Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges](https://agentprime.io/advisories/CVE-2026-53565.md)
  `CVE-2026-53565` · CVE record: Citrix Secure Access Client for Windows and 1 more · CVSS 8.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Privilege escalation
- [waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization](https://agentprime.io/advisories/CVE-2026-15594.md)
  `CVE-2026-15594` · CVE record: waooAI waoowaoo · CVSS 6.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account](https://agentprime.io/advisories/CVE-2026-61463.md)
  `CVE-2026-61463` · CVE record: go-shiori shiori · CVSS 8.7 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)](https://agentprime.io/advisories/CVE-2026-59245.md)
  `CVE-2026-59245` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 8.1 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [Redhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node root](https://agentprime.io/advisories/CVE-2026-15584.md)
  `CVE-2026-15584` · CVE record: Red Hat Pen Drive Powered by Red Hat Lightspeed · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-57813.md)
  `CVE-2026-57813` · CVE record: properfraction MailOptin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-57768.md)
  `CVE-2026-57768` · CVE record: favethemes Houzez Login Register · CVSS 8.2 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-57410.md)
  `CVE-2026-57410` · CVE record: MailerPress Team MailerPress · CVSS 8.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-57386.md)
  `CVE-2026-57386` · CVE record: Kodezen LLC aBlocks · CVSS 8.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file](https://agentprime.io/advisories/CVE-2026-52533.md)
  `CVE-2026-52533` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation
- [Leantime API saveSetting improper authorization](https://agentprime.io/advisories/CVE-2026-15510.md)
  `CVE-2026-15510` · CVE record: Leantime · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Leantime JSON-RPC Endpoint addUser improper authorization](https://agentprime.io/advisories/CVE-2026-15509.md)
  `CVE-2026-15509` · CVE record: Leantime · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [OpenWrt luci-app-samba4 read ACL remote code execution via smbd](https://agentprime.io/advisories/CVE-2026-59260.md)
  `CVE-2026-59260` · CVE record: openwrt luci · CVSS 8.7 High · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation
- [AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization](https://agentprime.io/advisories/CVE-2026-15499.md)
  `CVE-2026-15499` · CVE record: AstrBotDevs AstrBot · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [QILING Disk Master Kernel Driver diskbckp.sys access control](https://agentprime.io/advisories/CVE-2026-15476.md)
  `CVE-2026-15476` · CVE record: QILING Disk Master · CVSS 4.8 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control](https://agentprime.io/advisories/CVE-2026-15475.md)
  `CVE-2026-15475` · CVE record: MiniTool Partition Wizard · CVSS 4.8 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software audio.jsp improper authorization](https://agentprime.io/advisories/CVE-2026-15474.md)
  `CVE-2026-15474` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization](https://agentprime.io/advisories/CVE-2026-15473.md)
  `CVE-2026-15473` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software composeEmailAction.do improper authorization](https://agentprime.io/advisories/CVE-2026-15472.md)
  `CVE-2026-15472` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software pci_dss_status.jsp improper authorization](https://agentprime.io/advisories/CVE-2026-15471.md)
  `CVE-2026-15471` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software group.jsp improper authorization](https://agentprime.io/advisories/CVE-2026-15470.md)
  `CVE-2026-15470` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 11 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter](https://agentprime.io/advisories/CVE-2026-14262.md)
  `CVE-2026-14262` · CVE record: nicu_m Simple JWT Login – Allows you to use JWT on REST endpoints. · CVSS 8.8 High · Not analysed yet · Published 11 Jul 2026 · Tags: Privilege escalation
- [WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter](https://agentprime.io/advisories/CVE-2026-13756.md)
  `CVE-2026-13756` · CVE record: WP Grid Builder WP Grid Builder · CVSS 8.8 High · Not analysed yet · Published 11 Jul 2026 · Tags: Privilege escalation
- [Eleveo Call Recording Software sendlogfile improper authorization](https://agentprime.io/advisories/CVE-2026-15377.md)
  `CVE-2026-15377` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software statisticReportAction.do improper authorization](https://agentprime.io/advisories/CVE-2026-15376.md)
  `CVE-2026-15376` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization](https://agentprime.io/advisories/CVE-2026-15375.md)
  `CVE-2026-15375` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software Group roleAddAction.do improper authorization](https://agentprime.io/advisories/CVE-2026-15374.md)
  `CVE-2026-15374` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Call Recording Software userAddAction.do improper authorization](https://agentprime.io/advisories/CVE-2026-15373.md)
  `CVE-2026-15373` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to \_\_internal_auditor](https://agentprime.io/advisories/CVE-2026-40009.md)
  `CVE-2026-40009` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 6.5 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Sipeed PicoClaw Launcher access_control.go IPAllowlist access control](https://agentprime.io/advisories/CVE-2026-15319.md)
  `CVE-2026-15319` · CVE record: Sipeed PicoClaw · CVSS 6.9 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation, Broken access control
- [An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components](https://agentprime.io/advisories/CVE-2026-51119.md)
  `CVE-2026-51119` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: Privilege escalation
- [Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction](https://agentprime.io/advisories/CVE-2026-57501.md)
  `CVE-2026-57501` · CVE record: zen-browser desktop · CVSS 0.0 None · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Discourse: Signup-time primary_group_id assignment grants whisperer access](https://agentprime.io/advisories/CVE-2026-44787.md)
  `CVE-2026-44787` · CVE record: discourse discourse · CVSS 8.2 High · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [TOTOLINK EX200 Web boa.conf least privilege violation](https://agentprime.io/advisories/CVE-2026-15271.md)
  `CVE-2026-15271` · CVE record: TOTOLINK A3000RU and 4 more · CVSS 7.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation, CWE-272
- [D-link DIR-823G Web boa.conf least privilege violation](https://agentprime.io/advisories/CVE-2026-15270.md)
  `CVE-2026-15270` · CVE record: D-link DIR-823G · CVSS 7.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation, CWE-272
- [Prisma Browser: Local Privilege Escalation on macOS](https://agentprime.io/advisories/CVE-2026-0275.md)
  `CVE-2026-0275` · CVE record: Palo Alto Networks Prisma Browser · CVSS 2.0 Low · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability](https://agentprime.io/advisories/CVE-2026-0276.md)
  `CVE-2026-0276` · CVE record: Palo Alto Networks Cortex XDR Broker VM · CVSS 1.1 Low · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Multiple RBAC issues in XAPI](https://agentprime.io/advisories/CVE-2026-42486.md)
  `CVE-2026-42486` · CVE record: Xen XAPI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Multiple RBAC issues in XAPI](https://agentprime.io/advisories/CVE-2026-23562.md)
  `CVE-2026-23562` · CVE record: Xen XAPI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control](https://agentprime.io/advisories/CVE-2026-15188.md)
  `CVE-2026-15188` · CVE record: manjurulhoque django-job-portal · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Multiple RBAC issues in XAPI](https://agentprime.io/advisories/CVE-2026-23561.md)
  `CVE-2026-23561` · CVE record: Xen XAPI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Multiple RBAC issues in XAPI](https://agentprime.io/advisories/CVE-2026-23560.md)
  `CVE-2026-23560` · CVE record: Xen XAPI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Multiple RBAC issues in XAPI](https://agentprime.io/advisories/CVE-2026-23559.md)
  `CVE-2026-23559` · CVE record: Xen XAPI · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0](https://agentprime.io/advisories/CVE-2026-33390.md)
  `CVE-2026-33390` · CVE record: Nozomi Networks Guardian and 1 more · CVSS 7.2 High · Not analysed yet · Published 9 Jul 2026 · Tags: Privilege escalation
- [Frigate viewer can read logs exposing admin and camera credentials](https://agentprime.io/advisories/CVE-2026-54652.md)
  `CVE-2026-54652` · CVE record: blakeblackshear frigate · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: Privilege escalation, Information disclosure, Broken access control, CWE-598
- [Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter](https://agentprime.io/advisories/CVE-2026-14250.md)
  `CVE-2026-14250` · CVE record: themehunk TH Login Registration · CVSS 6.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Privilege escalation
- [多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters](https://agentprime.io/advisories/CVE-2026-14482.md)
  `CVE-2026-14482` · CVE record: shen2 多说社会化评论框 · CVSS 8.8 High · Not analysed yet · Published 8 Jul 2026 · Tags: Privilege escalation
- [Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities](https://agentprime.io/advisories/CVE-2026-9842.md)
  `CVE-2026-9842` · CVE record: pixelgrade Backstage – Customizer Demo Access · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Privilege escalation
- [FluxInk Color Management Driver local privilege escalation](https://agentprime.io/advisories/CVE-2026-58583.md)
  `CVE-2026-58583` · CVE record: FluxInk Color Management Driver · CVSS 8.4 High · Not analysed yet · Published 7 Jul 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA3LTA3VDIwOjMzOjM4LjY1ODAwMFoiLCJDVkUtMjAyNi01ODU4MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTA3LTE1VDIxOjExOjM4LjcxMTAwMFoiLCJDVkUtMjAyNi01MzQ0NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTA3LTE1VDIxOjExOjM4LjcxMTAwMFoiLCJDVkUtMjAyNi01MzQ0NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.