CWE-266— Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.— MITRE CWE catalog

1,310 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-266page 25 of 27

CVE-2025-13807MEDIUMCVSS 4.3EG 4.3
2025-12-01
A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyCon…
CVE-2025-12304MEDIUMCVSS 4.3EG 4.3
2025-10-27
A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation…
CVE-2025-11440MEDIUMCVSS 4.3EG 4.3
2025-10-08
A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been public…
CVE-2025-11080MEDIUMCVSS 4.3EG 4.3
2025-09-27
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoControlle…
CVE-2025-10822MEDIUMCVSS 4.3EG 4.3
2025-09-23
A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed from…
CVE-2025-10821MEDIUMCVSS 4.3EG 4.3
2025-09-22
A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This manipulation causes improper authorization. The attack is possible to be carried…
CVE-2025-10820MEDIUMCVSS 4.3EG 4.3
2025-09-22
A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is no…
CVE-2025-10819MEDIUMCVSS 4.3EG 4.3
2025-09-22
A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/queryAll. The manipulation leads to improper authorization. Remote exploitation of th…
CVE-2025-10676MEDIUMCVSS 4.3EG 4.3
2025-09-18
A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The expl…
CVE-2025-10675MEDIUMCVSS 4.3EG 4.3
2025-09-18
A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing manipulation results in improper authorization. Remote exploitation of the atta…
CVE-2025-10674MEDIUMCVSS 4.3EG 4.3
2025-09-18
A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll. Such manipulation leads to improper authorization. The attack may be launched r…
CVE-2025-10422MEDIUMCVSS 4.3EG 4.3
2025-09-15
A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of the argument orderN…
CVE-2025-10084MEDIUMCVSS 4.3EG 4.3
2025-09-08
A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLogController. The manipulation leads to improper authorization. It is possible to …
CVE-2025-10073MEDIUMCVSS 4.3EG 4.3
2025-09-08
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The e…
CVE-2025-9936MEDIUMCVSS 4.3EG 4.3
2025-09-04
A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. …
CVE-2025-48348MEDIUMCVSS 4.3EG 4.3
2025-08-28
Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Offline: from n/a through <= 1.5.7.
CVE-2025-8790MEDIUMCVSS 4.3EG 4.3
2025-08-10
A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been declared as critical. This vulnerability affects unknown code of the file /module/Api/pessoa of the component API Endpoint. The manipulation of the argument ID leads…
CVE-2025-6532MEDIUMCVSS 4.3EG 4.3
2025-06-24
A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper acc…
CVE-2025-6531MEDIUMCVSS 4.3EG 4.3
2025-06-24
A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability affects unknown code of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access contro…
CVE-2025-6525MEDIUMCVSS 4.3EG 4.3
2025-06-23
A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=set of the component Configuration Handler. The manipulation leads to improper a…
CVE-2025-5422MEDIUMCVSS 4.3EG 4.3
2025-06-02
A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of the component Email Logs Page. The manipulation leads to improper access controls.…
CVE-2025-4017MEDIUMCVSS 4.3EG 4.3
2025-04-28
A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the function list of the file nnovel-admin/src/main/java/com/java2nb/common/controller/Lo…
CVE-2025-3981MEDIUMCVSS 4.3EG 4.3
2025-04-27
A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some unknown processing of the file /v1/prescription/detai…
CVE-2025-3980MEDIUMCVSS 4.3EG 4.3
2025-04-27
A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of the file /v1/prescription/list. The manipulation le…
CVE-2025-3977MEDIUMCVSS 4.3EG 4.3
2025-04-27
A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/attachment/download of the component Attachment Handler. The…
CVE-2025-3567MEDIUMCVSS 4.3EG 4.3
2025-04-14
A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketIntercepto…
CVE-2025-3564MEDIUMCVSS 4.3EG 4.3
2025-04-14
A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teacher String Handler. The manipulation leads to improper authorization. It is poss…
CVE-2025-3550MEDIUMCVSS 4.3EG 4.3
2025-04-14
A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig…
CVE-2025-23407MEDIUMCVSS 4.3EG 4.3
2025-04-09
Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who can log in to the product may alter the settings without appropriate privileges.
CVE-2025-3325MEDIUMCVSS 4.3EG 4.3
2025-04-06
A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID lea…
CVE-2025-3305MEDIUMCVSS 4.3EG 4.3
2025-04-05
A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation…
CVE-2025-3298MEDIUMCVSS 4.3EG 4.3
2025-04-05
A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registr…
CVE-2025-3255MEDIUMCVSS 4.3EG 4.3
2025-04-04
A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/home. The manipulation of the argument ID leads to improper access cont…
CVE-2025-27095MEDIUMCVSS 4.3EG 4.3
2025-03-31
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig…
CVE-2025-2688MEDIUMCVSS 4.3EG 4.3
2025-03-24
A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5.9c.5185. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ExportSyslog.sh of the component Syslog Configuration File Handler. Th…
CVE-2025-2653MEDIUMCVSS 4.3EG 4.3
2025-03-23
A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been discl…
CVE-2025-2639MEDIUMCVSS 4.3EG 4.3
2025-03-23
A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of the component Article Handler. The manipulation leads to improper authorization…
CVE-2025-2638MEDIUMCVSS 4.3EG 4.3
2025-03-23
A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the component Article Handler. The manipulation of the argument ishot with the input 1 …
CVE-2025-2637MEDIUMCVSS 4.3EG 4.3
2025-03-23
A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of t…
CVE-2025-2553MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The a…
CVE-2025-2552MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/formTcpipSetup. The manipulation leads to improper access controls. Access…
CVE-2025-2551MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/formSetPortTr. The manipulation leads to improper access controls. Access to the lo…
CVE-2025-2550MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/formSetDDNS of the component DDNS Service. The manipulation leads to…
CVE-2025-2549MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/formSetPassword. The manipulation leads to improper acces…
CVE-2025-2548MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/formSetDomainFilter. The manipulation leads to improper access controls. The atta…
CVE-2025-2547MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of the file /goform/formAdvNetwork. The manipulation leads to improper access control…
CVE-2025-2546MEDIUMCVSS 4.3EG 4.3
2025-03-20
A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formAdvFirewall of the component Firewall Service. The manipulation leads to improper…
CVE-2025-1881MEDIUMCVSS 4.3EG 4.3
2025-03-03
A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Video Footage/Live Video Stream. The manipulation leads to im…
CVE-2025-1806MEDIUMCVSS 4.3EG 4.3
2025-03-02
A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to i…
CVE-2024-49348MEDIUMCVSS 4.3EG 4.3
2025-02-05
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows restricting access to organizational data to valid contexts. The fact that…

Map vulnerabilities like CWE-266 to your infrastructure

EchelonGraph correlates every CVE — across CWE-266 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →