# Privilege escalation.

Gaining rights a user or process shouldn’t have. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper privilege management in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-77172.md)
  `CVE-2026-77172` · CVE record: Nextcloud Server · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows](https://agentprime.io/advisories/CVE-2026-111584.md)
  `CVE-2026-111584` · CVE record: TeamViewer TeamViewer Remote - Patch Management · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows](https://agentprime.io/advisories/CVE-2026-111583.md)
  `CVE-2026-111583` · CVE record: TeamViewer Full Client and 1 more · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows](https://agentprime.io/advisories/CVE-2026-111582.md)
  `CVE-2026-111582` · CVE record: TeamViewer Remote Management - Monitoring · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key](https://agentprime.io/advisories/GHSA-7hp6-4w63-5g45.md)
  `GHSA-7hp6-4w63-5g45`, `CVE-2026-114612` · PyPI `litellm`: affected `>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2`, fixed in `1.100.4`, `1.101.3`, `1.102.2`, `1.103.1`, `1.104.0rc2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, CWE-345, CWE-441
- [Privilege escalation in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-118008.md)
  `CVE-2026-118008` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Privilege escalation in the Toolkit component](https://agentprime.io/advisories/CVE-2026-117981.md)
  `CVE-2026-117981` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-90728.md)
  `CVE-2026-90728` · CVE record: Dell PowerProtect Data Domain · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-90729.md)
  `CVE-2026-90729` · CVE record: Dell PowerProtect Data Domain · CVSS 6.7 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-117466.md)
  `CVE-2026-117466` · CVE record: Octopus Deploy Octopus Server · CVSS 8.6 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Supermicro BMC IPMI feature contains a Privilege escalation vulnerability](https://agentprime.io/advisories/CVE-2026-65220.md)
  `CVE-2026-65220` · CVE record: SMCI MBD-X12SPI · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Device-code claim permits restricted token escalation in Psono Server](https://agentprime.io/advisories/CVE-2026-117468.md)
  `CVE-2026-117468` · CVE record: esaqa GmbH Psono · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation](https://agentprime.io/advisories/CVE-2026-116806.md)
  `CVE-2026-116806` · CVE record: Openpanel-dev openpanel · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2026-113947.md)
  `CVE-2026-113947` · CVE record: Apple macOS · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2026-86896.md)
  `CVE-2026-86896` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Apple macOS](https://agentprime.io/advisories/CVE-2026-65373.md)
  `CVE-2026-65373` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [BKWLD Decoy Authorization Policy Policy.php privileges management](https://agentprime.io/advisories/CVE-2026-116471.md)
  `CVE-2026-116471` · CVE record: BKWLD Decoy · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [Bdtask Garage 24 Garage Management Software Backend improper authorization](https://agentprime.io/advisories/CVE-2026-116384.md)
  `CVE-2026-116384` · CVE record: Bdtask Garage 24 Garage Management Software · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [DeepSeek Harness Browser Auth browser-auth.ts improper authorization](https://agentprime.io/advisories/CVE-2026-116368.md)
  `CVE-2026-116368` · CVE record: DeepSeek Harness · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Improper Privilege Assignment in boneIO](https://agentprime.io/advisories/CVE-2026-77055.md)
  `CVE-2026-77055` · CVE record: boneIO black_debian_images · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [JIZHICMS Front-end Order OrderController.php pay improper authorization](https://agentprime.io/advisories/CVE-2026-116274.md)
  `CVE-2026-116274` · CVE record: JIZHICMS · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [icret EasyImage del.php privileges management](https://agentprime.io/advisories/CVE-2026-116223.md)
  `CVE-2026-116223` · CVE record: icret EasyImage · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [openbq-org OpenBB Local API Server api_settings.py access control](https://agentprime.io/advisories/CVE-2026-116108.md)
  `CVE-2026-116108` · CVE record: openbq-org OpenBB · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [HeyCyan App FileProvider access control](https://agentprime.io/advisories/CVE-2026-116106.md)
  `CVE-2026-116106` · CVE record: HeyCyan App · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.](https://agentprime.io/advisories/CVE-2026-106781.md)
  `CVE-2026-106781` · CVE record · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login](https://agentprime.io/advisories/CVE-2026-116162.md)
  `CVE-2026-116162` · CVE record: parse-community parse-server · CVSS 2.1 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Privilege escalation
- [Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade](https://agentprime.io/advisories/CVE-2026-115251.md)
  `CVE-2026-115251` · CVE record: Unknown Duplicator · CVSS 7.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: Privilege escalation
- [Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers](https://agentprime.io/advisories/CVE-2026-115214.md)
  `CVE-2026-115214` · CVE record: Unknown Datawiza Proxy Auth Plugin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Privilege escalation
- [aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute](https://agentprime.io/advisories/CVE-2026-110018.md)
  `CVE-2026-110018` · CVE record: kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder · CVSS 8.8 High · Not analysed yet · Published 24 Oct 2026 · Tags: Privilege escalation
- [User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute](https://agentprime.io/advisories/CVE-2026-115807.md)
  `CVE-2026-115807` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Privilege escalation
- [bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop](https://agentprime.io/advisories/CVE-2026-25784.md)
  `CVE-2026-25784` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation, CWE-1188
- [Remote Code Execution in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30046.md)
  `CVE-2025-30046` · CVE record: CGM CGM CLININET · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation
- [Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action](https://agentprime.io/advisories/CVE-2026-94268.md)
  `CVE-2026-94268` · CVE record: Unknown Advanced Custom Fields: Extended and 1 more · CVSS 8.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation
- [Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change](https://agentprime.io/advisories/CVE-2026-111982.md)
  `CVE-2026-111982` · CVE record: Unknown User Profile Builder · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation
- [Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10](https://agentprime.io/advisories/CVE-2026-95719.md)
  `CVE-2026-95719` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes](https://agentprime.io/advisories/CVE-2026-95716.md)
  `CVE-2026-95716` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-95711.md)
  `CVE-2026-95711` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-112242.md)
  `CVE-2026-112242` · CVE record: Cozmoslabs Profile Builder · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role](https://agentprime.io/advisories/CVE-2026-109927.md)
  `CVE-2026-109927` · CVE record: Unknown HIPAA Forms · CVSS 7.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite](https://agentprime.io/advisories/CVE-2026-114658.md)
  `CVE-2026-114658` · CVE record: getgrav grav-plugin-login · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161](https://agentprime.io/advisories/CVE-2026-96363.md)
  `CVE-2026-96363` · CVE record: Drupal Webform · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162](https://agentprime.io/advisories/CVE-2026-96367.md)
  `CVE-2026-96367` · CVE record: Drupal Webform · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166](https://agentprime.io/advisories/CVE-2026-96371.md)
  `CVE-2026-96371` · CVE record: Drupal Webform · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185](https://agentprime.io/advisories/CVE-2026-96390.md)
  `CVE-2026-96390` · CVE record: Drupal Editoria11y Accessibility Checker · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Privilege escalation
- [HarnessRouter Identity Mode app.py improper authorization](https://agentprime.io/advisories/CVE-2026-114361.md)
  `CVE-2026-114361` · CVE record: HarnessRouter · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide](https://agentprime.io/advisories/CVE-2026-110744.md)
  `CVE-2026-110744` · CVE record: Red Hat Multicluster Global Hub · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation
- [Multiple Cisco Products Snort 3 Software Hardening Release: October 2026](https://agentprime.io/advisories/CVE-2026-20291.md)
  `CVE-2026-20291` · CVE record: Cisco Cisco Cyber Vision and 3 more · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation
- [dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization](https://agentprime.io/advisories/CVE-2026-114249.md)
  `CVE-2026-114249` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation, Broken access control
- [dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization](https://agentprime.io/advisories/CVE-2026-114245.md)
  `CVE-2026-114245` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation, Broken access control
- [WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect](https://agentprime.io/advisories/CVE-2026-110523.md)
  `CVE-2026-110523` · CVE record: Unknown WP User Manager · CVSS 8.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation
- [Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting](https://agentprime.io/advisories/CVE-2026-107506.md)
  `CVE-2026-107506` · CVE record: Unknown Simple Banner · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation
- [Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint](https://agentprime.io/advisories/CVE-2026-114069.md)
  `CVE-2026-114069` · CVE record: triggerdotdev trigger.dev · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Data Integrator](https://agentprime.io/advisories/CVE-2026-91668.md)
  `CVE-2026-91668` · CVE record: Oracle Corporation Oracle Data Integrator · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91649.md)
  `CVE-2026-91649` · CVE record: Oracle Corporation Oracle Essbase · CVSS 6.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Communications Billing and Revenue Management](https://agentprime.io/advisories/CVE-2026-91627.md)
  `CVE-2026-91627` · CVE record: Oracle Corporation Oracle Communications Billing and Revenue Management · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle OLAP](https://agentprime.io/advisories/CVE-2026-91563.md)
  `CVE-2026-91563` · CVE record: Oracle Corporation Oracle OLAP · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91557.md)
  `CVE-2026-91557` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 7.0 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle GoldenGate](https://agentprime.io/advisories/CVE-2026-91547.md)
  `CVE-2026-91547` · CVE record: Oracle Corporation Oracle GoldenGate · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91539.md)
  `CVE-2026-91539` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-91537.md)
  `CVE-2026-91537` · CVE record: Oracle Corporation Oracle Solaris · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/tag/privilege-escalation.md>
Older: <https://agentprime.io/advisories/tag/privilege-escalation.md?cursor=WyIyMDI2LTEwLTIwVDIxOjI2OjI2LjcxMjAwMFoiLCJDVkUtMjAyNi05MTUzNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=privilege-escalation&cursor=WyIyMDI2LTEwLTI3VDE3OjU4OjQ2LjI1NzAwMFoiLCJDVkUtMjAyNi01NzIwMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/privilege-escalation/?cursor=WyIyMDI2LTEwLTI3VDE3OjU4OjQ2LjI1NzAwMFoiLCJDVkUtMjAyNi01NzIwMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.