# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management](https://agentprime.io/advisories/CVE-2026-18606.md)
  `CVE-2026-18606` · CVE record: Razer RzUpdateService · CVSS 8.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Privilege escalation
- [CVE-2026-15430](https://agentprime.io/advisories/CVE-2026-15430.md)
  `CVE-2026-15430` · CVE record: Wellbia XIGNCODE3 · CVSS 6.2 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Privilege escalation, Broken access control
- [Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration](https://agentprime.io/advisories/CVE-2026-67609.md)
  `CVE-2026-67609` · CVE record: Telenia Software TVox · CVSS 8.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: Privilege escalation
- [Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import](https://agentprime.io/advisories/CVE-2026-16534.md)
  `CVE-2026-16534` · CVE record: Unknown Import and export users and customers · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Privilege escalation
- [GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization](https://agentprime.io/advisories/CVE-2026-18584.md)
  `CVE-2026-18584` · CVE record: GL.iNet E5800 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Privilege escalation, Broken access control
- [ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger](https://agentprime.io/advisories/CVE-2026-67356.md)
  `CVE-2026-67356` · CVE record: ArcadeData arcadedb · CVSS 8.7 High · Not analysed yet · Published 2 Aug 2026 · Tags: Privilege escalation
- [Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation](https://agentprime.io/advisories/CVE-2026-16256.md)
  `CVE-2026-16256` · CVE record: Unknown POUCO Import Users · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Aug 2026 · Tags: Privilege escalation
- [Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field](https://agentprime.io/advisories/CVE-2026-16635.md)
  `CVE-2026-16635` · CVE record: pronamic Pronamic Pay · CVSS 8.8 High · Not analysed yet · Published 1 Aug 2026 · Tags: Privilege escalation
- [Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration](https://agentprime.io/advisories/CVE-2026-15368.md)
  `CVE-2026-15368` · CVE record: Unknown User Profile Builder · CVSS 8.1 High · Not analysed yet · Published 1 Aug 2026 · Tags: Privilege escalation
- [Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '\_wps_plan_user_role' Membership Plan Meta](https://agentprime.io/advisories/CVE-2026-15414.md)
  `CVE-2026-15414` · CVE record: wpswings Subscriptions for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 1 Aug 2026 · Tags: Privilege escalation
- [Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)](https://agentprime.io/advisories/GHSA-jr6p-8pjj-mfx6.md)
  `GHSA-jr6p-8pjj-mfx6`, `CVE-2026-65835`, `GO-2026-6157` · Go `github.com/projectcapsule/capsule`: affected `>=0.13.0, <0.13.8`, fixed in `0.13.8` · CVSS 6.6 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field](https://agentprime.io/advisories/CVE-2026-12251.md)
  `CVE-2026-12251` · CVE record: Unknown Ultimate Member · CVSS 8.1 High · Not analysed yet · Published 31 Jul 2026 · Tags: Privilege escalation
- [Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory](https://agentprime.io/advisories/CVE-2026-14333.md)
  `CVE-2026-14333` · CVE record: Unknown Demi · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Privilege escalation
- [IBM WebSphere Application Server Liberty is affected by a cross-site request forgery](https://agentprime.io/advisories/CVE-2026-14980.md)
  `CVE-2026-14980` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 8.3 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID](https://agentprime.io/advisories/CVE-2026-12687.md)
  `CVE-2026-12687` · CVE record: Unknown ProfileGrid · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17969.md)
  `CVE-2026-17969` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17956.md)
  `CVE-2026-17956` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17952.md)
  `CVE-2026-17952` · CVE record: Google Chrome · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17950.md)
  `CVE-2026-17950` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17877.md)
  `CVE-2026-17877` · CVE record: Google Chrome · CVSS 8.4 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17868.md)
  `CVE-2026-17868` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17864.md)
  `CVE-2026-17864` · CVE record: Google Chrome · CVSS 7.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17863.md)
  `CVE-2026-17863` · CVE record: Google Chrome · CVSS 7.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17816.md)
  `CVE-2026-17816` · CVE record: Google Chrome · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17751.md)
  `CVE-2026-17751` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-17744.md)
  `CVE-2026-17744` · CVE record: Google Chrome · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: Privilege escalation
- [fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)](https://agentprime.io/advisories/CVE-2026-52791.md)
  `CVE-2026-52791` · CVE record: containers fuse-overlayfs · CVSS 2.0 Low · Not analysed yet · Published 29 Jul 2026 · Tags: Privilege escalation
- [Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter](https://agentprime.io/advisories/CVE-2026-12144.md)
  `CVE-2026-12144` · CVE record: saadiqbal Wholesale for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 29 Jul 2026 · Tags: Privilege escalation
- [Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption](https://agentprime.io/advisories/GHSA-qf5v-m7p4-95rp.md)
  `GHSA-qf5v-m7p4-95rp`, `CVE-2026-50570`, `GO-2026-6129` · Go `github.com/fission/fission`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 8.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Privilege escalation, Broken access control
- [WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation](https://agentprime.io/advisories/CVE-2026-15992.md)
  `CVE-2026-15992` · CVE record: teydeastudio WP Password Policy · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Privilege escalation
- [Criu: criu: container escape via rseq critical section hijack during checkpoint/restore](https://agentprime.io/advisories/CVE-2026-18107.md)
  `CVE-2026-18107` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in EnterpriseDB pglogical](https://agentprime.io/advisories/CVE-2026-50737.md)
  `CVE-2026-50737` · CVE record: EnterpriseDB pglogical · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Privilege escalation
- [Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint](https://agentprime.io/advisories/CVE-2026-14328.md)
  `CVE-2026-14328` · CVE record: eazyplugins Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Privilege escalation
- [TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset](https://agentprime.io/advisories/CVE-2026-14545.md)
  `CVE-2026-14545` · CVE record: Unknown TrueBooker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Privilege escalation
- [JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.](https://agentprime.io/advisories/CVE-2026-66015.md)
  `CVE-2026-66015` · CVE record: jfrog artifactory · CVSS 7.2 High · Not analysed yet · Published 27 Jul 2026 · Tags: Privilege escalation
- [phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership](https://agentprime.io/advisories/CVE-2026-66399.md)
  `CVE-2026-66399` · CVE record: thorsten phpMyFAQ · CVSS 8.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: Privilege escalation
- [Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation](https://agentprime.io/advisories/CVE-2026-13152.md)
  `CVE-2026-13152` · CVE record: Unknown Custom Fields Account Registration For Woocommerce · CVSS 8.1 High · Not analysed yet · Published 27 Jul 2026 · Tags: Privilege escalation
- [MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-12394.md)
  `CVE-2026-12394` · CVE record: Unknown MemberGlut · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: Privilege escalation
- [nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization](https://agentprime.io/advisories/CVE-2026-17434.md)
  `CVE-2026-17434` · CVE record: nanocoai NanoClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Jul 2026 · Tags: Privilege escalation, Broken access control
- [nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization](https://agentprime.io/advisories/CVE-2026-17433.md)
  `CVE-2026-17433` · CVE record: nanocoai NanoClaw · CVSS 4.8 Medium · Not analysed yet · Published 26 Jul 2026 · Tags: Privilege escalation, Broken access control
- [NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control](https://agentprime.io/advisories/CVE-2026-17432.md)
  `CVE-2026-17432` · CVE record: NousResearch hermes-agent · CVSS 2.3 Low · Not analysed yet · Published 26 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Budibase: Privilege escalation via public role assignment API missing app-level authorization](https://agentprime.io/advisories/GHSA-j9fc-w3mr-x6mv.md)
  `GHSA-j9fc-w3mr-x6mv`, `CVE-2026-73305` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo](https://agentprime.io/advisories/CVE-2026-12502.md)
  `CVE-2026-12502` · CVE record: Loytec LIP-ME20xC and 4 more · CVSS 8.4 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users](https://agentprime.io/advisories/CVE-2026-16743.md)
  `CVE-2026-16743` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [Local privilege escalation in ESET security applications for macOS](https://agentprime.io/advisories/CVE-2026-10610.md)
  `CVE-2026-10610` · CVE record: ESET spol. s.r.o. ESET Endpoint Security for macOS and 1 more · CVSS 8.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [Local privilege escalation in ESET security applications for macOS](https://agentprime.io/advisories/CVE-2026-7483.md)
  `CVE-2026-7483` · CVE record: ESET spol. s.r.o. ESET Endpoint Security for macOS and 1 more · CVSS 8.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset](https://agentprime.io/advisories/CVE-2026-12981.md)
  `CVE-2026-12981` · CVE record: Unknown CAFEHAUS API · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection](https://agentprime.io/advisories/CVE-2026-12497.md)
  `CVE-2026-12497` · CVE record: Unknown Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation](https://agentprime.io/advisories/CVE-2026-14172.md)
  `CVE-2026-14172` · CVE record: Rapid7 InsightVM and 2 more · CVSS 7.8 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint](https://agentprime.io/advisories/CVE-2026-12736.md)
  `CVE-2026-12736` · CVE record: wpify WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce · CVSS 8.0 High · Not analysed yet · Published 24 Jul 2026 · Tags: Privilege escalation
- [OWASP DefectDojo API/Web serializers.py UserSerializer privileges management](https://agentprime.io/advisories/CVE-2026-16764.md)
  `CVE-2026-16764` · CVE record: OWASP DefectDojo · CVSS 5.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [victor Web - Priviledge Escalation](https://agentprime.io/advisories/CVE-2026-34496.md)
  `CVE-2026-34496` · CVE record: Johnson Controls victor Web · CVSS 7.1 High · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [CVE-2026-15630](https://agentprime.io/advisories/CVE-2026-15630.md)
  `CVE-2026-15630` · CVE record: Casdoor Casdoor · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation, Broken access control
- [Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups](https://agentprime.io/advisories/CVE-2026-65897.md)
  `CVE-2026-65897` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-61951.md)
  `CVE-2026-61951` · CVE record: themetechmount TrueBooker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-59541.md)
  `CVE-2026-59541` · CVE record: Hakan Ozevin WP BASE Booking · CVSS 8.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-59540.md)
  `CVE-2026-59540` · CVE record: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers](https://agentprime.io/advisories/CVE-2026-15017.md)
  `CVE-2026-15017` · CVE record: mdjm MDJM Event Management · CVSS 8.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation
- [An issue in Unistal Systems Pvt.](https://agentprime.io/advisories/CVE-2026-38764.md)
  `CVE-2026-38764` · CVE record · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: Privilege escalation, CWE-782
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-61246.md)
  `CVE-2026-61246` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Authentication bypass, Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA3LTIyVDIyOjI0OjI3Ljc2NTAwMFoiLCJDVkUtMjAyNi02MTI0NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTA4LTA0VDAxOjQ1OjEwLjIzNzAwMFoiLCJDVkUtMjAyNi0xODcyMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTA4LTA0VDAxOjQ1OjEwLjIzNzAwMFoiLCJDVkUtMjAyNi0xODcyMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.