# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-104757.md)
  `CVE-2026-104757` · CVE record: Javier Carazo Import and export users and customers · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-104405.md)
  `CVE-2026-104405` · CVE record: Nexcess GiveWP · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-95594.md)
  `CVE-2026-95594` · CVE record: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-48197.md)
  `CVE-2026-48197` · CVE record: PublishPress PublishPress Capabilities · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39775.md)
  `CVE-2026-39775` · CVE record: DexignZone JobZilla - Job Board WordPress Theme · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39774.md)
  `CVE-2026-39774` · CVE record: Tourfic AI Studio Tourfic Pro · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39773.md)
  `CVE-2026-39773` · CVE record: AmentoTech Doctreat Core · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39765.md)
  `CVE-2026-39765` · CVE record: WebAppick Challan · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39761.md)
  `CVE-2026-39761` · CVE record: eLightUp Meta Box AIO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39753.md)
  `CVE-2026-39753` · CVE record: AmentoTech Taskbot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization](https://agentprime.io/advisories/CVE-2026-105621.md)
  `CVE-2026-105621` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization](https://agentprime.io/advisories/CVE-2026-105611.md)
  `CVE-2026-105611` · CVE record: chillzhuang SpringBlade · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization](https://agentprime.io/advisories/CVE-2026-105610.md)
  `CVE-2026-105610` · CVE record: chillzhuang SpringBlade · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [PickMall Lilishop Mobile Binding bindMobile improper authorization](https://agentprime.io/advisories/CVE-2026-105571.md)
  `CVE-2026-105571` · CVE record: PickMall Lilishop · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Nx daemon and plugin worker sockets are accessible to other local users](https://agentprime.io/advisories/GHSA-w3vv-58gj-gw77.md)
  `GHSA-w3vv-58gj-gw77`, `CVE-2026-104854` · npm `nx`: affected `>=14.6.0, <22.7.9 || >=23.0.0, <23.1.2`, fixed in `22.7.9`, `23.1.2` · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)](https://agentprime.io/advisories/CVE-2026-105688.md)
  `CVE-2026-105688` · CVE record: penpot penpot · CVSS 6.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection](https://agentprime.io/advisories/CVE-2026-105687.md)
  `CVE-2026-105687` · CVE record: penpot penpot · CVSS 4.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-28647.md)
  `CVE-2026-28647` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-28641.md)
  `CVE-2026-28641` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-28625.md)
  `CVE-2026-28625` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-58841.md)
  `CVE-2026-58841` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles](https://agentprime.io/advisories/CVE-2026-105634.md)
  `CVE-2026-105634` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization](https://agentprime.io/advisories/CVE-2026-105382.md)
  `CVE-2026-105382` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)](https://agentprime.io/advisories/CVE-2026-104955.md)
  `CVE-2026-104955` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization](https://agentprime.io/advisories/CVE-2026-105284.md)
  `CVE-2026-105284` · CVE record: Totolink A3002MU · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering](https://agentprime.io/advisories/CVE-2026-105126.md)
  `CVE-2026-105126` · CVE record: laradashboard laradashboard · CVSS 8.6 High · Not analysed yet · Published 3 Oct 2026 · Tags: Privilege escalation
- [Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /…](https://agentprime.io/advisories/CVE-2026-97644.md)
  `CVE-2026-97644` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2026 · Tags: Privilege escalation
- [gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled](https://agentprime.io/advisories/GHSA-x4q3-gcj3-m6cf.md)
  `GHSA-x4q3-gcj3-m6cf`, `CVE-2026-73802`, `GO-2026-6656` · Go `gitea.com/gitea/runner`: affected `<1.0.9-0.20260731160927-34bfa1915022`, fixed in `1.0.9-0.20260731160927-34bfa1915022` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Privilege escalation
- [Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter](https://agentprime.io/advisories/CVE-2026-19652.md)
  `CVE-2026-19652` · CVE record: DiviEngine Divi Membership · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Privilege escalation
- [Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login](https://agentprime.io/advisories/CVE-2026-15897.md)
  `CVE-2026-15897` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: Privilege escalation
- [EasyIO FG](https://agentprime.io/advisories/CVE-2026-27872.md)
  `CVE-2026-27872` · CVE record: Johnson Controls Easy IO FG · CVSS 5.6 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [VxWorks 7 improper privilege management](https://agentprime.io/advisories/CVE-2026-104018.md)
  `CVE-2026-104018` · CVE record: Wind River Systems Inc VxWorks 7 · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Foreman: excessive permissions for viewer role on preview](https://agentprime.io/advisories/CVE-2026-96659.md)
  `CVE-2026-96659` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function](https://agentprime.io/advisories/CVE-2026-59797.md)
  `CVE-2026-59797` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes](https://agentprime.io/advisories/GHSA-6rh5-qq4q-97xh.md)
  `GHSA-6rh5-qq4q-97xh`, `CVE-2026-92958` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 8.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process](https://agentprime.io/advisories/GHSA-8686-vhfx-7r3j.md)
  `GHSA-8686-vhfx-7r3j`, `CVE-2026-92957` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-103068.md)
  `CVE-2026-103068` · CVE record: ByteCore Stack ByteCoreStack \&#8211; MCP Connector for AI Tools · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-103752.md)
  `CVE-2026-103752` · CVE record: Paul Ryan Authorizer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [HCL iControl is affected by multiple security vulnerabilities](https://agentprime.io/advisories/CVE-2026-66246.md)
  `CVE-2026-66246` · CVE record: HCL Software iControl · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications](https://agentprime.io/advisories/CVE-2026-103286.md)
  `CVE-2026-103286` · CVE record: TryGhost Ghost · CVSS 8.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user…](https://agentprime.io/advisories/CVE-2026-103494.md)
  `CVE-2026-103494` · CVE record: JetBrains YouTrack · CVSS 6.6 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint](https://agentprime.io/advisories/CVE-2026-95687.md)
  `CVE-2026-95687` · CVE record: wpclever WPC Shop as a Customer for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool](https://agentprime.io/advisories/CVE-2026-19807.md)
  `CVE-2026-19807` · CVE record: bytecorestack ByteCoreStack – MCP Connector for AI Tools · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter](https://agentprime.io/advisories/CVE-2026-15989.md)
  `CVE-2026-15989` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Genians, Inc Genian SSL PNS Improper Privilege Management](https://agentprime.io/advisories/CVE-2026-76145.md)
  `CVE-2026-76145` · CVE record: Genians, Inc Genian SSL PNS (frodo-core) and 1 more · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control](https://agentprime.io/advisories/CVE-2026-103534.md)
  `CVE-2026-103534` · CVE record: David-Crty databasement · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization](https://agentprime.io/advisories/CVE-2026-103532.md)
  `CVE-2026-103532` · CVE record: immich-app Immich · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Kiteworks Core Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102112.md)
  `CVE-2026-102112` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection, Privilege escalation
- [Kiteworks Core Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102113.md)
  `CVE-2026-102113` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102118.md)
  `CVE-2026-102118` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Core OS Command Injection](https://agentprime.io/advisories/CVE-2026-102120.md)
  `CVE-2026-102120` · CVE record: Kiteworks Core · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection, Privilege escalation
- [Kiteworks Core Incorrect Privilege Assignment](https://agentprime.io/advisories/CVE-2026-102129.md)
  `CVE-2026-102129` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Kiteworks Core Privilege Escalation through External Control of File Name or Path](https://agentprime.io/advisories/CVE-2026-102141.md)
  `CVE-2026-102141` · CVE record: Kiteworks Core · CVSS 6.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Core improper privilege management](https://agentprime.io/advisories/CVE-2026-102093.md)
  `CVE-2026-102093` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Taskcluster: Unauthenticated remote code execution in \`web-server\` via GraphQL \`filter\` argument (sift \`$where\`)](https://agentprime.io/advisories/CVE-2026-55094.md)
  `CVE-2026-55094` · CVE record: taskcluster taskcluster · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, Privilege escalation, Authentication bypass, CWE-20
- [Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant](https://agentprime.io/advisories/CVE-2026-53605.md)
  `CVE-2026-53605` · CVE record: pollen-robotics reachy-mini-os · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package](https://agentprime.io/advisories/CVE-2026-102490.md)
  `CVE-2026-102490` · CVE record: Zammad GmbH Zammad · CVSS 8.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.11 · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Internet2 Grouper: In Internet2 Grouper before 7.5.1 (in some configurations)…](https://agentprime.io/advisories/CVE-2026-103470.md)
  `CVE-2026-103470` · CVE record: Internet2 Grouper · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-97245.md)
  `CVE-2026-97245` · CVE record: SureCart SureCart · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96821.md)
  `CVE-2026-96821` · CVE record: Mahmudul Hasan Arif FluentBoards · CVSS 6.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjM0LjcyMDAwMFoiLCJDVkUtMjAyNi05NjgyMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTEwLTA2VDA4OjM1OjIwLjgxODAwMFoiLCJDVkUtMjAyNi0xMDUwNTgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTEwLTA2VDA4OjM1OjIwLjgxODAwMFoiLCJDVkUtMjAyNi0xMDUwNTgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.