# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization](https://agentprime.io/advisories/CVE-2026-108890.md)
  `CVE-2026-108890` · CVE record: BlackBeltTechnology pi-agent-dashboard · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management](https://agentprime.io/advisories/CVE-2026-108835.md)
  `CVE-2026-108835` · CVE record: Yungengxin Yun Jia Security Guard · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation
- [yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management](https://agentprime.io/advisories/CVE-2026-108825.md)
  `CVE-2026-108825` · CVE record: yangzongzhuan RuoYi · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation
- [agno-agi agno Delegation Feature \_default_tools.py member_agent.run unnecessary privileges](https://agentprime.io/advisories/CVE-2026-108820.md)
  `CVE-2026-108820` · CVE record: agno-agi agno · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation
- [SEMCMS SEMCMS_User.php user improper authorization](https://agentprime.io/advisories/CVE-2026-108812.md)
  `CVE-2026-108812` · CVE record: SEMCMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21123.md)
  `CVE-2026-21123` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.7 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation
- [ZKTeco BioTime System Settings API systemSettings access control](https://agentprime.io/advisories/CVE-2026-108795.md)
  `CVE-2026-108795` · CVE record: ZKTeco BioTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization](https://agentprime.io/advisories/CVE-2026-108575.md)
  `CVE-2026-108575` · CVE record: BerriAI LiteLLM · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation](https://agentprime.io/advisories/CVE-2026-85126.md)
  `CVE-2026-85126` · CVE record: Unknown Crowdfundly · CVSS 7.2 High · Not analysed yet · Published 11 Oct 2026 · Tags: Privilege escalation
- [AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion](https://agentprime.io/advisories/CVE-2026-85118.md)
  `CVE-2026-85118` · CVE record: Unknown AI Content Generator Marketing · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Privilege escalation
- [Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard](https://agentprime.io/advisories/CVE-2026-104680.md)
  `CVE-2026-104680` · CVE record: Unknown Envira Gallery · CVSS 7.2 High · Not analysed yet · Published 11 Oct 2026 · Tags: Privilege escalation
- [Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin](https://agentprime.io/advisories/CVE-2026-103694.md)
  `CVE-2026-103694` · CVE record: Unknown Mobile builder · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Privilege escalation
- [WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-62022.md)
  `CVE-2026-62022` · CVE record: Select-Themes Tonda Membership · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39801.md)
  `CVE-2026-39801` · CVE record: Sergey AIWU · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-106610.md)
  `CVE-2026-106610` · CVE record: miniOrange miniorange otp verification · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96341.md)
  `CVE-2026-96341` · CVE record: WPMU DEV Forminator · CVSS 8.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-106608.md)
  `CVE-2026-106608` · CVE record: Automattic WooCommerce · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Unauthorized access vulnerability in ZTE Z80 Ultra product](https://agentprime.io/advisories/CVE-2026-108506.md)
  `CVE-2026-108506` · CVE record: ZTE Z80 Ultra · CVSS 5.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Information disclosure vulnerability in ZTE Z80 Ultra product](https://agentprime.io/advisories/CVE-2026-108505.md)
  `CVE-2026-108505` · CVE record: ZTE Z80 Ultra · CVSS 3.3 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product](https://agentprime.io/advisories/CVE-2026-108504.md)
  `CVE-2026-108504` · CVE record: ZTE Z80 Ultra · CVSS 5.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Information disclosure vulnerability in ZTE Z80 Ultra product](https://agentprime.io/advisories/CVE-2026-108502.md)
  `CVE-2026-108502` · CVE record: ZTE Z80 Ultra · CVSS 3.3 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset](https://agentprime.io/advisories/CVE-2026-94257.md)
  `CVE-2026-94257` · CVE record: Unknown SMS Alert · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion](https://agentprime.io/advisories/CVE-2026-92975.md)
  `CVE-2026-92975` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint](https://agentprime.io/advisories/CVE-2026-77183.md)
  `CVE-2026-77183` · CVE record: foosales FooSales – Point of Sale (POS) for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter](https://agentprime.io/advisories/CVE-2026-104725.md)
  `CVE-2026-104725` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings\[default_wp_role_for_customer\]' Parameter](https://agentprime.io/advisories/CVE-2026-104766.md)
  `CVE-2026-104766` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Unauthorized access vulnerability in ZTE Z80 Ultra product](https://agentprime.io/advisories/CVE-2026-108501.md)
  `CVE-2026-108501` · CVE record: ZTE ZTE Z80 Ultra · CVSS 5.7 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter](https://agentprime.io/advisories/CVE-2026-107645.md)
  `CVE-2026-107645` · CVE record: creativethemeshq Blocksy Companion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint](https://agentprime.io/advisories/CVE-2026-104022.md)
  `CVE-2026-104022` · CVE record: kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)](https://agentprime.io/advisories/GHSA-pjr3-86v4-5p7w.md)
  `GHSA-pjr3-86v4-5p7w`, `CVE-2026-111920`, `GO-2026-6745` · Go `code.vikunja.io/api`: affected `>=2.6.0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Vikunja: Scoped API token can mint unrestricted OAuth session credentials](https://agentprime.io/advisories/GHSA-v3p6-34mc-hj7v.md)
  `GHSA-v3p6-34mc-hj7v`, `CVE-2026-57458`, `GO-2026-6750` · Go `code.vikunja.io/api`: affected `>=2.3.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation
- [WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96539.md)
  `CVE-2026-96539` · CVE record: Ultimate Member Ultimate Member · CVSS 5.6 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation
- [Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension](https://agentprime.io/advisories/CVE-2025-14123.md)
  `CVE-2025-14123` · CVE record: davidanderson Redux Framework · CVSS 6.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation
- [Privilege Escalation in Telerik Report Server Service-Agent Hub](https://agentprime.io/advisories/CVE-2026-106145.md)
  `CVE-2026-106145` · CVE record: Progress Software Telerik Report Server · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation
- [FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation](https://agentprime.io/advisories/CVE-2026-93548.md)
  `CVE-2026-93548` · CVE record: Unknown FooSales · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation
- [IBM Guardium Data Protection Privilege Escalation](https://agentprime.io/advisories/CVE-2026-84245.md)
  `CVE-2026-84245` · CVE record: IBM Guardium Data Protection · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right](https://agentprime.io/advisories/CVE-2026-50054.md)
  `CVE-2026-50054` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx](https://agentprime.io/advisories/CVE-2026-9209.md)
  `CVE-2026-9209` · CVE record: mJob mJobTime · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation, Authentication bypass
- [Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader](https://agentprime.io/advisories/CVE-2026-93017.md)
  `CVE-2026-93017` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.12 and 4 more · CVSS 7.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Authenticated argument injection in NIOS command line leading to privilege escalation](https://agentprime.io/advisories/CVE-2026-107510.md)
  `CVE-2026-107510` · CVE record: Infoblox NIOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Privilege escalation, Broken access control
- [Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call](https://agentprime.io/advisories/CVE-2026-103692.md)
  `CVE-2026-103692` · CVE record: Unknown Frontend Dashboard · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94578.md)
  `CVE-2026-94578` · CVE record: Brocade Fabric OS · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87681.md)
  `CVE-2026-87681` · CVE record: Brocade Fabric OS · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76266.md)
  `CVE-2026-76266` · CVE record: Splunk Splunk Enterprise · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation
- [Ghost: Editors Could Promote Staff Users to Their Own Role](https://agentprime.io/advisories/GHSA-4pvx-fwjj-8gpc.md)
  `GHSA-4pvx-fwjj-8gpc`, `BIT-ghost-2026-104412`, `BIT-ghost-2026-105678`, `CVE-2026-104412`, `CVE-2026-105678` · npm `ghost`: affected `>=0.5.0, <6.64.0`, fixed in `6.64.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret](https://agentprime.io/advisories/CVE-2026-107176.md)
  `CVE-2026-107176` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.19 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation
- [Backstage: Improper preservation of access restrictions during service credential delegation](https://agentprime.io/advisories/GHSA-cq7v-rfgc-5c7v.md)
  `GHSA-cq7v-rfgc-5c7v`, `CVE-2026-106492` · npm `@backstage/backend-defaults`: affected `<0.17.8`, fixed in `0.17.8` · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation, Broken access control
- [wger: Trainer Privilege Escalation - Improper Privilege Management](https://agentprime.io/advisories/GHSA-x249-cx55-2h87.md)
  `GHSA-x249-cx55-2h87`, `CVE-2026-46434`, `PYSEC-2026-4316` · PyPI `wger`: affected `<=2.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation
- [Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-87782.md)
  `CVE-2026-87782` · CVE record: Unknown Koinonia Link · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation
- [Local Privilege Escalation in ClearPass Client Software](https://agentprime.io/advisories/CVE-2026-79813.md)
  `CVE-2026-79813` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 6.7 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agent](https://agentprime.io/advisories/CVE-2026-79806.md)
  `CVE-2026-79806` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 7.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Authenticated Privilege Escalation Vulnerability in the API of AOS-S](https://agentprime.io/advisories/CVE-2026-76748.md)
  `CVE-2026-76748` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Authentication Bypass in the Web Management Interface of AOS-S](https://agentprime.io/advisories/CVE-2026-76742.md)
  `CVE-2026-76742` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-106296.md)
  `CVE-2026-106296` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Execution with unnecessary privileges in Google Chrome](https://agentprime.io/advisories/CVE-2026-106378.md)
  `CVE-2026-106378` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-55307.md)
  `CVE-2026-55307` · CVE record: Google Android · CVSS 4.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell Container Storage Modules (CSM)](https://agentprime.io/advisories/CVE-2026-67269.md)
  `CVE-2026-67269` · CVE record: Dell Container Storage Modules (CSM) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation](https://agentprime.io/advisories/GHSA-8qpj-27x8-pwpq.md)
  `GHSA-8qpj-27x8-pwpq`, `CVE-2026-10561`, `PYSEC-2026-4231` · PyPI `langflow`: affected `<1.10.1`, fixed in `1.10.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection, Privilege escalation
- [WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-105070.md)
  `CVE-2026-105070` · CVE record: Dimitri Grassi Salon booking system · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-105058.md)
  `CVE-2026-105058` · CVE record: John James Jacoby WP User Profiles · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTEwLTA2VDA4OjM1OjIwLjgxODAwMFoiLCJDVkUtMjAyNi0xMDUwNTgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTEwLTEyVDE1OjE1OjEyLjMxMzAwMFoiLCJDVkUtMjAyNi0xMDg4OTkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTEwLTEyVDE1OjE1OjEyLjMxMzAwMFoiLCJDVkUtMjAyNi0xMDg4OTkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.