Privilege escalation.

Gallagher Command Centre Server: An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server…

• Gallagher Command Centre Server
• Privilege escalation

FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation

• FOSSBilling
• Privilege escalation

Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

• Privilege escalation

>=4.0.0-RC1 || >=5.0.0-RC1 · no fixed version yet

Formbricks Survey actions.ts access control

• Formbricks
• Privilege escalation
• Broken access control

SourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization

• SourceCodester Onlne Examination & Learning Management System
• Privilege escalation
• Broken access control

SourceCodester Onlne Examination & Learning Management System Registration Endpoint register.php privileges management

• SourceCodester Onlne Examination & Learning Management System
• Privilege escalation

SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization

• SourceCodester Multi-Vendor Online Grocery Management System
• Privilege escalation
• Broken access control

SourceCodester Multi-Vendor Online Grocery Management System Users.php save_users improper authorization

• SourceCodester Multi-Vendor Online Grocery Management System
• Privilege escalation
• Broken access control

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

• Privilege escalation
• Broken access control

<4.2.0 · fixed in 4.2.0

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

• weaviate
• Privilege escalation

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

• Information disclosure
• Privilege escalation

<2026.5.20 · fixed in 2026.5.20

OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

• Privilege escalation
• Broken access control

<2026.5.18 · fixed in 2026.5.18

Keycloak has privilege escalation via improper scope mapping enforcement

• Privilege escalation

<26.6.4 · fixed in 26.6.4

WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability

• LCweb PrivateContent
• Privilege escalation

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Privilege escalation

Privilege Escalation in MCO

• MyComplianceOffice MCO
• Privilege escalation
• Broken access control

LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

• LatePoint – Calendar Booking Plugin for Appointments and Events
• Privilege escalation

Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint

• wedevs Dokan Pro
• Privilege escalation

Improper privilege management in Google Chrome

• Google Chrome
• Privilege escalation

Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment

• Capgo
• Privilege escalation

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

• Privilege escalation

<1.24.0 · fixed in 1.24.0

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

• Privilege escalation
• Information disclosure

<1.24.0 · fixed in 1.24.0

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

• Privilege escalation
• Broken access control

<1.24.0 · fixed in 1.24.0

Fission Container Executor Function PodSpec Injection Leading to Node Escape

• Privilege escalation
• Broken access control

<1.24.0 · fixed in 1.24.0

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

• Privilege escalation
• Broken access control

<1.24.0 · fixed in 1.24.0

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

• Information disclosure
• Privilege escalation

<1.24.0 · fixed in 1.24.0

Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.8
• Privilege escalation

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Privilege escalation

A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM

• Nokia MantaRay NM
• Privilege escalation

DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization

• DeepMyst Mysti
• Privilege escalation
• Broken access control

SourceCodester Inventory Management System User Registration Endpoint users_handler.php access control

• SourceCodester Inventory Management System
• Privilege escalation
• Broken access control

praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

• Privilege escalation
• Broken access control

<0.1.4 · fixed in 0.1.4

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

• Privilege escalation
• Broken access control

<0.1.4 · fixed in 0.1.4

praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}

• Privilege escalation
• Broken access control

<0.1.4 · fixed in 0.1.4

O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.

• OPPO O+ Connect
• Privilege escalation

Feehi CMS API users access control

• Feehi CMS
• Privilege escalation
• Broken access control

CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization

• CherryHQ cherry-studio
• Privilege escalation
• Broken access control

VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization

• VoltAgent
• Privilege escalation
• Broken access control

Gitea act_runner - Container Hardening Bypass via Workflow Container Options

• Gitea act_runner
• Privilege escalation

Flaw in Linuxulator execution of setugid binaries

• FreeBSD
• Privilege escalation

sigqueue(2) missing capability mode restriction

• FreeBSD
• Privilege escalation

Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

• pravel Invoice Generator
• Privilege escalation

WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability

• Dokan Multivendor Plugin Dokan Pro
• Privilege escalation

WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability

• Paytium
• Privilege escalation

WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability

• themewant Easy Elements for Elementor &#8211; Addons &amp; Website Templates
• Privilege escalation

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability

• Tyche Softwares. Abandoned Cart Pro for WooCommerce
• Privilege escalation

WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability

• ThemeFusion Fusion Builder
• Privilege escalation

Missing permission check in thr_kill2(2)

• FreeBSD
• Privilege escalation

Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC

• Cap-go capgo
• Privilege escalation

Privilege Escalation in Fortra File Integrity Monitoring (FIM)

• Fortra File Integrity Monitoring (FIM)
• Privilege escalation

motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

• Path traversal
• Privilege escalation

<0.44.0 · fixed in 0.44.0

Gogs's write-level collaborators can mutate admin-only repository settings via API

• Privilege escalation
• Broken access control

<0.14.3 · fixed in 0.14.3

Capgo - Authorization Bypass in API Key Management via App-Limited Keys

• Capgo
• Privilege escalation

Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters

• Red Hat OpenShift for Windows Containers 10.19
• Red Hat OpenShift for Windows Containers 10.20
• Privilege escalation

Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation

• Vitepos
• Privilege escalation

Browserbase Skills Autobrowse Trace Artifact default permission

• Browserbase Skills
• Privilege escalation
• Broken access control

Capgo - Privilege Escalation via Broken Row Level Security in org_users

• Capgo
• Privilege escalation

Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage

• Capgo
• Privilege escalation

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

• Privilege escalation
• Broken access control

<=1.82.2 · no fixed version yet

Ezbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control

• Ezbsystems UltraISO Premium Edition
• Privilege escalation
• Broken access control