1912 matches found
EUVD-2026-58367
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management...
EUVD-2026-58220
Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...
CVE-2026-72631
Kibana Fleet vulnerability CVE-2026-72631: Improper Privilege Management can allow an Elastic Agent API key issued to agents in a policy to gain additional write rights (insert new documents and extend index mappings) for certain indices by including extra data streams in the integration policy. ...
EUVD-2026-58227
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management...
PT-2026-71808
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management...
CVE-2026-73842: Improper Privilege Management
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...
PT-2026-71728
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper privilege management in the HTTP Server may allow a local attacker to gain elevated privileges. Recommendations At the moment, there is no information about a newer version that contains a fi...
PT-2026-71835
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management...
CVE-2026-73664: Improper Privilege Management
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorizedkeys for the asterisk system user without reliably enforcing backup-only...
CVE-2026-24059: Improper Privilege Management
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-73305: Improper Privilege Management
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...
Security Bulletin: IBM i is Affected By An Improper Management Vulnerability in HTTP Server [CVE-2026-18071]
Summary IBM i is vulnerable to elevated privileges due to improper privilege management CVE-2026-18071 in HTTP Server as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18071 DESCRIPTION: IBM i could allow a local attacker to gain elevated privileges due to...
Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP [CVE-2026-17438]
Summary IBM i is vulnerable to obtaining sensitive information or modifying data due to improper privilege management CVE-2026-17438 in Lightweight Directory Access Protocol LDAP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17438 DESCRIPTION: IBM i could...
EUVD-2026-57358
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...
CVE-2026-73293: Improper Privilege Management
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...
CVE-2026-18366: Improper Privilege Management
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...
CVE-2026-73284: Improper Privilege Management
RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets...
CVE-2026-73122: Improper Privilege Management
A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...