# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter](https://agentprime.io/advisories/CVE-2026-14279.md)
  `CVE-2026-14279` · CVE record: cedcommerce Wholesale Market · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2026 · Tags: Privilege escalation
- [bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings](https://agentprime.io/advisories/CVE-2026-15001.md)
  `CVE-2026-15001` · CVE record: connectordev bLoyal: Loyalty & Promotions by bLoyal · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2026 · Tags: Privilege escalation
- [Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter](https://agentprime.io/advisories/CVE-2026-15312.md)
  `CVE-2026-15312` · CVE record: fassionstorage Propovoice: All-in-One Client Management System · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2026 · Tags: Privilege escalation
- [Microsoft Defender Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69414.md)
  `CVE-2026-69414` · CVE record: Microsoft Microsoft Malware Protection Engine · CVSS 7.8 High · Not analysed yet · Published 14 Aug 2026 · Tags: Path traversal, Privilege escalation
- [TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission](https://agentprime.io/advisories/CVE-2026-19841.md)
  `CVE-2026-19841` · CVE record: TRENDNET TEW-813DRU · CVSS 2.3 Low · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Dell Wyse Management Suite (WMS)](https://agentprime.io/advisories/CVE-2026-63700.md)
  `CVE-2026-63700` · CVE record: Dell Wyse Management Suite (WMS) · CVSS 7.8 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell Wyse Management Suite (WMS)](https://agentprime.io/advisories/CVE-2026-63701.md)
  `CVE-2026-63701` · CVE record: Dell Wyse Management Suite (WMS) · CVSS 6.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [CVE-2026-16772](https://agentprime.io/advisories/CVE-2026-16772.md)
  `CVE-2026-16772` · CVE record: Akaunting Akaunting · CVSS 8.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation, Broken access control
- [Webkul Bagisto Customer Item Deletion Endpoint access control](https://agentprime.io/advisories/CVE-2026-19835.md)
  `CVE-2026-19835` · CVE record: Webkul Bagisto · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation, Broken access control
- [Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys](https://agentprime.io/advisories/CVE-2026-72833.md)
  `CVE-2026-72833` · CVE record: getgrav grav-plugin-api · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass](https://agentprime.io/advisories/CVE-2026-72830.md)
  `CVE-2026-72830` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav before 1.0.13 API Key Scope Bypass via UsersController](https://agentprime.io/advisories/CVE-2026-72829.md)
  `CVE-2026-72829` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav before 1.0.13 API Key Scope Bypass via InvitationsController](https://agentprime.io/advisories/CVE-2026-72828.md)
  `CVE-2026-72828` · CVE record: getgrav grav · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Grav API Plugin before 1.0.13 Scope Bypass via createApiKey](https://agentprime.io/advisories/CVE-2026-72826.md)
  `CVE-2026-72826` · CVE record: getgrav grav-plugin-api · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment](https://agentprime.io/advisories/CVE-2026-18039.md)
  `CVE-2026-18039` · CVE record: Unknown Essential Addons for Elementor · CVSS 8.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: Privilege escalation
- [OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write](https://agentprime.io/advisories/CVE-2026-72840.md)
  `CVE-2026-72840` · CVE record: openwrt luci · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [filebrowser through 2.63.16 Privilege Escalation via Signup](https://agentprime.io/advisories/CVE-2026-72839.md)
  `CVE-2026-72839` · CVE record: filebrowser filebrowser · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module](https://agentprime.io/advisories/CVE-2026-73664.md)
  `CVE-2026-73664` · CVE record: FreePBX backup · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation, Broken access control
- [IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime](https://agentprime.io/advisories/CVE-2026-18249.md)
  `CVE-2026-18249` · CVE record: IBM i · CVSS 8.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime](https://agentprime.io/advisories/CVE-2026-18193.md)
  `CVE-2026-18193` · CVE record: IBM i · CVSS 8.9 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty](https://agentprime.io/advisories/CVE-2026-18101.md)
  `CVE-2026-18101` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP \[\]](https://agentprime.io/advisories/CVE-2026-17438.md)
  `CVE-2026-17438` · CVE record: IBM i · CVSS 4.4 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM](https://agentprime.io/advisories/CVE-2026-17074.md)
  `CVE-2026-17074` · CVE record: IBM i · CVSS 3.1 Low · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL \[\]](https://agentprime.io/advisories/CVE-2026-16722.md)
  `CVE-2026-16722` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys](https://agentprime.io/advisories/CVE-2026-72631.md)
  `CVE-2026-72631` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By An Improper Management Vulnerability in HTTP Server \[\]](https://agentprime.io/advisories/CVE-2026-18071.md)
  `CVE-2026-18071` · CVE record: IBM i · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [Gitea runner registration-token GET endpoint performs a write under a read-only token scope](https://agentprime.io/advisories/CVE-2026-24059.md)
  `CVE-2026-24059` · CVE record: Gitea Gitea Open Source Git Server · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-66661.md)
  `CVE-2026-66661` · CVE record: Onokazu Directories Pro · CVSS 7.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-66424.md)
  `CVE-2026-66424` · CVE record: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-61979.md)
  `CVE-2026-61979` · CVE record: miniOrange SAML SP Single Sign On · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-28161.md)
  `CVE-2026-28161` · CVE record: Aonetheme Service Finder Booking · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-27543.md)
  `CVE-2026-27543` · CVE record: FluxBuilder MStore API · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration](https://agentprime.io/advisories/CVE-2026-13610.md)
  `CVE-2026-13610` · CVE record: Unknown KiviCare · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd](https://agentprime.io/advisories/CVE-2026-49819.md)
  `CVE-2026-49819` · CVE record: seriousm4x UpSnap · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Command injection, Privilege escalation, Authentication bypass, Broken access control
- [Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege](https://agentprime.io/advisories/CVE-2026-71846.md)
  `CVE-2026-71846` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (\*/\*/\*)](https://agentprime.io/advisories/CVE-2026-72508.md)
  `CVE-2026-72508` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Multiple Vulnerabilities in the Debug Server](https://agentprime.io/advisories/CVE-2026-17082.md)
  `CVE-2026-17082` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon \[\]](https://agentprime.io/advisories/CVE-2026-17445.md)
  `CVE-2026-17445` · CVE record: IBM i · CVSS 8.2 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Incorrect Privilege Assignment in GitLab](https://agentprime.io/advisories/CVE-2025-9486.md)
  `CVE-2025-9486` · CVE record: GitLab GitLab · CVSS 3.3 Low · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa](https://agentprime.io/advisories/CVE-2026-73269.md)
  `CVE-2026-73269` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By A Privilege Escalation Vulnerability \[\]](https://agentprime.io/advisories/CVE-2026-18669.md)
  `CVE-2026-18669` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Multiple Vulnerabilities in SQL](https://agentprime.io/advisories/CVE-2026-17110.md)
  `CVE-2026-17110` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i](https://agentprime.io/advisories/CVE-2026-17276.md)
  `CVE-2026-17276` · CVE record: IBM i · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i](https://agentprime.io/advisories/CVE-2026-18713.md)
  `CVE-2026-18713` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [IBM i is Affected By improper privilege management in Navigator for i](https://agentprime.io/advisories/CVE-2026-16904.md)
  `CVE-2026-16904` · CVE record: IBM i · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [WebPros Plesk: Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2…](https://agentprime.io/advisories/CVE-2026-64639.md)
  `CVE-2026-64639` · CVE record: WebPros Plesk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Project Resource Managers may escalate privileges in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68752.md)
  `CVE-2026-68752` · CVE record: jfrog artifactory · CVSS 7.2 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts](https://agentprime.io/advisories/CVE-2026-73284.md)
  `CVE-2026-73284` · CVE record: rustfs rustfs · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-18366.md)
  `CVE-2026-18366` · CVE record: Unknown Events Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces](https://agentprime.io/advisories/CVE-2026-73122.md)
  `CVE-2026-73122` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 7.7 High · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache](https://agentprime.io/advisories/CVE-2026-71468.md)
  `CVE-2026-71468` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings](https://agentprime.io/advisories/CVE-2026-18702.md)
  `CVE-2026-18702` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update](https://agentprime.io/advisories/CVE-2026-15426.md)
  `CVE-2026-15426` · CVE record: acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Cursor: Sandbox escape via launching privileged containers](https://agentprime.io/advisories/CVE-2026-73218.md)
  `CVE-2026-73218` · CVE record: cursor cursor · CVSS 7.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Windows Package Manager Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-68821.md)
  `CVE-2026-68821` · CVE record: Microsoft App Installer · CVSS 7.3 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-59133.md)
  `CVE-2026-59133` · CVE record: Microsoft Microsoft HPC Pack 2019 · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Improper privilege management in Intel(R) PROSet/Wireless WiFi Software for Windows](https://agentprime.io/advisories/CVE-2026-20890.md)
  `CVE-2026-20890` · CVE record: Intel(R) PROSet/Wireless WiFi Software for Windows · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Authentik Security authentik - Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72537.md)
  `CVE-2026-72537` · CVE record: Authentik Security authentik · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Authentik Security authentik - Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72534.md)
  `CVE-2026-72534` · CVE record: Authentik Security authentik · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles](https://agentprime.io/advisories/CVE-2026-18982.md)
  `CVE-2026-18982` · CVE record: Red Hat Red Hat OpenShift AI 2.25 and 3 more · CVSS 8.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA4LTEwVDIwOjQ1OjE5LjM0OTAwMFoiLCJDVkUtMjAyNi0xODk4MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTA4LTE1VDA4OjI3OjE2LjQ0OTAwMFoiLCJDVkUtMjAyNi0xNTE0MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTA4LTE1VDA4OjI3OjE2LjQ0OTAwMFoiLCJDVkUtMjAyNi0xNTE0MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.