# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96815.md)
  `CVE-2026-96815` · CVE record: appsbd Vitepos · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96350.md)
  `CVE-2026-96350` · CVE record: Estatik Estatik · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-94178.md)
  `CVE-2026-94178` · CVE record: Javier Carazo Import and export users and customers · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption](https://agentprime.io/advisories/CVE-2026-75823.md)
  `CVE-2026-75823` · CVE record: Unknown User Frontend · CVSS 7.4 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [An information disclosure vulnerability in ZTE U30 Air product](https://agentprime.io/advisories/CVE-2026-86556.md)
  `CVE-2026-86556` · CVE record: ZTE U30 Air · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization](https://agentprime.io/advisories/CVE-2026-102846.md)
  `CVE-2026-102846` · CVE record: gedelumbung HospitalManagement · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-102317.md)
  `CVE-2026-102317` · CVE record: Google Chrome · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Authenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Instant ON](https://agentprime.io/advisories/CVE-2026-76732.md)
  `CVE-2026-76732` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 6.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Authentication Bypass in the Captive Portal of HPE Networking Instant On](https://agentprime.io/advisories/CVE-2026-76731.md)
  `CVE-2026-76731` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions](https://agentprime.io/advisories/GHSA-gr2m-v5gq-v685.md)
  `GHSA-gr2m-v5gq-v685`, `CVE-2026-102674` · npm `electron`: affected `<41.10.6 || >=42.0.0-alpha.1, <42.9.2 || >=43.0.0-alpha.1, <43.4.1 || >=44.0.0-alpha.1, <44.0.0-beta.5`, fixed in `41.10.6`, `42.9.2`, `43.4.1`, `44.0.0-beta.5` · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation, CWE-693
- [Electron: \<webview> can enable Node.js integration in Web Workers despite embedder restrictions](https://agentprime.io/advisories/GHSA-9qh4-3jw8-366w.md)
  `GHSA-9qh4-3jw8-366w`, `CVE-2026-102676` · npm `electron`: affected `<41.10.6 || >=42.0.0-alpha.1, <42.9.2 || >=43.0.0-alpha.1, <43.4.1 || >=44.0.0-alpha.1, <44.0.0-beta.5`, fixed in `41.10.6`, `42.9.2`, `43.4.1`, `44.0.0-beta.5` · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation, CWE-1188
- [Improper privilege management in Eclipse Foundation Eclipse ThreadX](https://agentprime.io/advisories/CVE-2026-102710.md)
  `CVE-2026-102710` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation, Memory corruption
- [Privilege escalation in the Places component](https://agentprime.io/advisories/CVE-2026-100824.md)
  `CVE-2026-100824` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Privilege escalation in the Address Bar component](https://agentprime.io/advisories/CVE-2026-100820.md)
  `CVE-2026-100820` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Privilege escalation in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-100807.md)
  `CVE-2026-100807` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Privilege escalation in the DLL Services component](https://agentprime.io/advisories/CVE-2026-100801.md)
  `CVE-2026-100801` · CVE record: Mozilla Thunderbird and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization](https://agentprime.io/advisories/CVE-2026-102293.md)
  `CVE-2026-102293` · CVE record: realjerrytang tacomall · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation, Broken access control
- [FastAdmin Database Management database.php unnecessary privileges](https://agentprime.io/advisories/CVE-2026-102247.md)
  `CVE-2026-102247` · CVE record: FastAdmin · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management](https://agentprime.io/advisories/CVE-2026-101860.md)
  `CVE-2026-101860` · CVE record: RaspAP raspap-webgui · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation
- [Eleveo Call Recording Software Query Builder searchAction.do access control](https://agentprime.io/advisories/CVE-2026-101144.md)
  `CVE-2026-101144` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters](https://agentprime.io/advisories/CVE-2026-88808.md)
  `CVE-2026-88808` · CVE record: SUSE Rancher · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation
- [Fleet applies namespace labels and annotations without the bundle's service account privileges](https://agentprime.io/advisories/CVE-2026-93540.md)
  `CVE-2026-93540` · CVE record: SUSE Rancher · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation
- [Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control](https://agentprime.io/advisories/CVE-2026-101054.md)
  `CVE-2026-101054` · CVE record: Thinkware U3000 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control](https://agentprime.io/advisories/CVE-2026-101053.md)
  `CVE-2026-101053` · CVE record: Thinkware U3000 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Authenticated File Write to RCE via keepalived in DDI Central](https://agentprime.io/advisories/CVE-2026-12269.md)
  `CVE-2026-12269` · CVE record: Zohocorp DDI Central · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Unrestricted file upload
- [Krayin laravel-crm acl.php access control](https://agentprime.io/advisories/CVE-2026-100883.md)
  `CVE-2026-100883` · CVE record: Krayin laravel-crm · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Nezha Dashboard before 2.3.5 Task Type Validation Bypass](https://agentprime.io/advisories/CVE-2026-101086.md)
  `CVE-2026-101086` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Privilege escalation
- [WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings](https://agentprime.io/advisories/CVE-2026-89001.md)
  `CVE-2026-89001` · CVE record: Unknown WPeMatico RSS Feed Fetcher · CVSS 4.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Privilege escalation
- [Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode](https://agentprime.io/advisories/CVE-2026-77203.md)
  `CVE-2026-77203` · CVE record: itthinx Groups – Memberships and Access Control · CVSS 8.8 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps](https://agentprime.io/advisories/CVE-2026-100686.md)
  `CVE-2026-100686` · CVE record: budibase server · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account](https://agentprime.io/advisories/CVE-2026-100620.md)
  `CVE-2026-100620` · CVE record: Cap-go @capgo/cli · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [Capgo OTA Manifest Poisoning via app_versions.manifest Bypass](https://agentprime.io/advisories/CVE-2026-100619.md)
  `CVE-2026-100619` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation](https://agentprime.io/advisories/CVE-2026-100615.md)
  `CVE-2026-100615` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list](https://agentprime.io/advisories/CVE-2026-100611.md)
  `CVE-2026-100611` · CVE record: Cap-go capgo.app · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind](https://agentprime.io/advisories/CVE-2026-100586.md)
  `CVE-2026-100586` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [OpenClaw before 2026.7.1 Authorization Bypass via chat.send](https://agentprime.io/advisories/CVE-2026-100578.md)
  `CVE-2026-100578` · CVE record: OpenClaw OpenClaw · CVSS 7.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: Privilege escalation
- [GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)](https://agentprime.io/advisories/CVE-2026-45801.md)
  `CVE-2026-45801` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [krayin laravel-crm User Management UserController.php privileges management](https://agentprime.io/advisories/CVE-2026-97895.md)
  `CVE-2026-97895` · CVE record: krayin laravel-crm · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [Zammad: Incorrect Authorization and Improper Privilege Management](https://agentprime.io/advisories/CVE-2026-56733.md)
  `CVE-2026-56733` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE](https://agentprime.io/advisories/CVE-2026-96812.md)
  `CVE-2026-96812` · CVE record: Google gVisor · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation, Information disclosure
- [Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field](https://agentprime.io/advisories/CVE-2026-89426.md)
  `CVE-2026-89426` · CVE record: knitpay Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment](https://agentprime.io/advisories/CVE-2026-93901.md)
  `CVE-2026-93901` · CVE record: ihomefinder Optima Express IDX · CVSS 7.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter](https://agentprime.io/advisories/CVE-2026-14281.md)
  `CVE-2026-14281` · CVE record: 101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privilege…](https://agentprime.io/advisories/CVE-2026-79153.md)
  `CVE-2026-79153` · CVE record · CVSS 7.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization](https://agentprime.io/advisories/CVE-2026-97324.md)
  `CVE-2026-97324` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER](https://agentprime.io/advisories/CVE-2026-52853.md)
  `CVE-2026-52853` · CVE record: docmost docmost · CVSS 5.2 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation
- [authentik: Privilege Escalation to Superuser via Group Hierarchy](https://agentprime.io/advisories/CVE-2026-94609.md)
  `CVE-2026-94609` · CVE record: goauthentik authentik · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control
- [TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization](https://agentprime.io/advisories/CVE-2026-96882.md)
  `CVE-2026-96882` · CVE record: TaleLin lin-cms-spring-boot · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control
- [TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization](https://agentprime.io/advisories/CVE-2026-96881.md)
  `CVE-2026-96881` · CVE record: TaleLin lin-cms-spring-boot · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control
- [TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization](https://agentprime.io/advisories/CVE-2026-96880.md)
  `CVE-2026-96880` · CVE record: TaleLin lin-cms-spring-boot · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field\[pt-user-role\]' Parameter](https://agentprime.io/advisories/CVE-2026-18467.md)
  `CVE-2026-18467` · CVE record: paytiumsupport Paytium: Mollie payment forms & donations · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation
- [kvcache-ai mooncake MountSegment Request Processing segment.cpp access control](https://agentprime.io/advisories/CVE-2026-96763.md)
  `CVE-2026-96763` · CVE record: kvcache-ai mooncake · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile…](https://agentprime.io/advisories/CVE-2026-86583.md)
  `CVE-2026-86583` · CVE record: carazo Import and export users and customers · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization](https://agentprime.io/advisories/CVE-2026-96556.md)
  `CVE-2026-96556` · CVE record: Neethuharii CafeManagement · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Execution with unnecessary privileges in WebPros cPanel](https://agentprime.io/advisories/CVE-2026-87899.md)
  `CVE-2026-87899` · CVE record: WebPros cPanel · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames](https://agentprime.io/advisories/CVE-2026-84716.md)
  `CVE-2026-84716` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-19087.md)
  `CVE-2026-19087` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 4.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-61413.md)
  `CVE-2026-61413` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-84787.md)
  `CVE-2026-84787` · CVE record: Zohocorp ManageEngine OpManager and 1 more · CVSS 8.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17645.md)
  `CVE-2026-17645` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA5LTIyVDIxOjQxOjEwLjIwMTAwMFoiLCJDVkUtMjAyNi0xNzY0NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjM0LjcyMDAwMFoiLCJDVkUtMjAyNi05NjgyMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjM0LjcyMDAwMFoiLCJDVkUtMjAyNi05NjgyMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.