Privilege escalation.

SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

• SuiteCRM
• Privilege escalation

Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints

• immich
• Privilege escalation
• Broken access control

Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders

• Apache Software Foundation Apache OFBiz
• Privilege escalation

Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter

• TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter
• Privilege escalation

GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

• stellarwp GiveWP – Donation Plugin and Fundraising Platform
• Privilege escalation

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy

• kyverno
• Privilege escalation

Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

• kyverno
• Privilege escalation

Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

• kyverno
• Privilege escalation

InvoiceShelf MemberService.php create access control

• InvoiceShelf
• Privilege escalation
• Broken access control

Incorrect privilege assignment issue exists in Hinemos.

• NTT DATA INTELLILINK Corporation Hinemos
• Privilege escalation

VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Privilege escalation

yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management

• yangzongzhuan RuoYi-Vue
• Privilege escalation

WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

• Crocoblock JetFormBuilder
• Privilege escalation

WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

• Uncanny Owl Uncanny Toolkit for LearnDash
• Privilege escalation

Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters

• rnlab Mobile builder
• Privilege escalation

Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

• WSO2 Identity Server
• WSO2 Identity Application Management Component
• Privilege escalation

miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control

• miroslavpejic85 MiroTalk P2P
• Privilege escalation
• Broken access control

EasySoft ZenTao PMS User model.php checkGroupChange privileges management

• EasySoft ZenTao PMS
• Privilege escalation

Execution with unnecessary privileges in Google Chrome

• Google Chrome
• Privilege escalation

Execution with unnecessary privileges in Google Chrome

• Google Chrome
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Babelfish for PostgreSQL Privilege Escalation

• AWS babelfish-for-postgresql
• Privilege escalation

GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning

• GLPI
• Privilege escalation

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

• surrealdb
• Privilege escalation

User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege

• Eclipse Foundation Eclipse ThreadX
• Privilege escalation
• Broken access control

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Improper privilege management in Dell Alienware Command Center (AWCC)

• Dell Alienware Command Center (AWCC)
• Privilege escalation

Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

• SUSE Rancher
• Privilege escalation

Apache Syncope: AuthProfile value escalation via self-service update

• Apache Software Foundation Apache Syncope
• Privilege escalation

Prefab UI Pyodide sandbox escape to host RCE

• PrefectHQ prefab-ui
• Code injection
• Privilege escalation

Beta9 build sandbox escape via chroot-only isolation

• beam-cloud Beta9 worker
• Privilege escalation
• CWE-653

Oray Pugongying X5 Pro API Authorization run_async_task improper authorization

• Oray Pugongying X5 Pro
• Privilege escalation
• Broken access control

ken678 YznCMS Auth Group Group.php Backend privileges management

• ken678 YznCMS
• Privilege escalation

User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

• wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
• Privilege escalation

Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

• roxnor Rox Appointment Booking – Event, Calendar & Appointment Scheduling
• Privilege escalation

Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure

• wardee Mail logging & Catcher
• Privilege escalation

Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_role

• Essential Addons for Elementor
• Privilege escalation

IXP Manager has authenticated non-administrator privilege escalation

• inex IXP-Manager
• Privilege escalation
• CWE-20

Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

• shopper
• Cross-site scripting (XSS)
• Privilege escalation

NovumOS: Nova Interpreter Privilege Escalation

• MinecAnton209 NovumOS
• Privilege escalation

Kargo: Privilege escalation via Project RBAC management in the Kargo API

• akuity kargo
• Privilege escalation

WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability

• Hakan Ozevin WP BASE Booking
• Privilege escalation

WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability

• Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications
• Privilege escalation

WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability

• Cozmoslabs Profile Builder
• Privilege escalation

Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update

• akbilisim Ak Framework
• Privilege escalation

Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

• wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
• Privilege escalation

AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes

• looplj AxonHub
• Privilege escalation

Improper privilege management in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Privilege escalation

Credential exposure to space supporter

• Cloud Foundry Controller (CAPI)
• Cloud Foundry cf-deployment
• Privilege escalation

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

• Drupal Custom Formatters
• Privilege escalation

WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

• Buddyboss Platform
• Privilege escalation

LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset

• LogixFast Auth
• Privilege escalation

n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

• n8n
• Privilege escalation

Improper privilege management in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Privilege escalation

BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation

• rankingcoach BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility
• Privilege escalation

Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

• magepeopleteam Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
• Privilege escalation

GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings

• GoSMTP
• Privilege escalation

Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

• jhuckaby Cronicle
• Privilege escalation
• Broken access control

Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

• asterisk
• certified-asterisk
• Privilege escalation
• CWE-1220