Common Weakness Enumeration
CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
1929 vulnerabilities reference this CWE, most recent first.
GHSA-7FG5-VC77-69FP
Vulnerability from github – Published: 2026-06-01 03:30 – Updated: 2026-07-07 23:43
VLAI
Summary
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
Details
A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "15.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-10215"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T23:43:39Z",
"nvd_published_at": "2026-06-01T03:16:25Z",
"severity": "LOW"
},
"details": "A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.",
"id": "GHSA-7fg5-vc77-69fp",
"modified": "2026-07-07T23:43:39Z",
"published": "2026-06-01T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10215"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/issues/37752"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/issues/37752#issuecomment-4304055921"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2"
},
{
"type": "WEB",
"url": "https://github.com/user-attachments/files/26487388/2_Dolibarr_Leave_Request_API_Horizontal_Unauthorized_Read_en.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-10215"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/821930"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367494"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367494/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API"
}
GHSA-7FRH-GCMM-Q865
Vulnerability from github – Published: 2022-10-17 19:00 – Updated: 2022-10-19 12:00
VLAI
Details
A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2022-3549"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-434"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-17T12:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability.",
"id": "GHSA-7frh-gcmm-q865",
"modified": "2022-10-19T12:00:19Z",
"published": "2022-10-17T19:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3549"
},
{
"type": "WEB",
"url": "https://github.com/Ramansh123454/POCs/blob/main/CSMS_RCE"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.211049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7FWG-H4WF-X2R5
Vulnerability from github – Published: 2025-04-01 21:31 – Updated: 2026-04-01 18:34
VLAI
Details
Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation. This issue affects Salon booking system: from n/a through 10.11.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2025-31560"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T21:15:50Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation. This issue affects Salon booking system: from n/a through 10.11.",
"id": "GHSA-7fwg-h4wf-x2r5",
"modified": "2026-04-01T18:34:26Z",
"published": "2025-04-01T21:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31560"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-11-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GMX-VW6R-9XRM
Vulnerability from github – Published: 2026-03-02 09:30 – Updated: 2026-03-02 09:30
VLAI
Details
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-15597"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T07:16:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.",
"id": "GHSA-7gmx-vw6r-9xrm",
"modified": "2026-03-02T09:30:30Z",
"published": "2026-03-02T09:30:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15597"
},
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707295"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707294"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707293"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707288"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707286"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707285"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707284"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707283"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.706144"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.348291"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.348291"
},
{
"type": "WEB",
"url": "https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md"
},
{
"type": "WEB",
"url": "https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md"
},
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot/releases/tag/v1.5.0"
},
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GP3-6WQ2-PF7V
Vulnerability from github – Published: 2025-09-13 21:31 – Updated: 2025-09-13 21:31
VLAI
Details
A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-10374"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-13T19:15:31Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.",
"id": "GHSA-7gp3-6wq2-pf7v",
"modified": "2025-09-13T21:31:36Z",
"published": "2025-09-13T21:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10374"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323788"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323788"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.639092"
},
{
"type": "WEB",
"url": "https://www.yuque.com/hongzh0/tx13c7/lgb05p6ar7ybugcz"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GPQ-5JCR-FH27
Vulnerability from github – Published: 2025-09-08 00:30 – Updated: 2025-09-08 00:30
VLAI
Details
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-10073"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-08T00:15:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-7gpq-5jcr-fh27",
"modified": "2025-09-08T00:30:19Z",
"published": "2025-09-08T00:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10073"
},
{
"type": "WEB",
"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Api.turma.md"
},
{
"type": "WEB",
"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10073.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323021"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323021"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.644136"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GXR-VXJ9-9X53
Vulnerability from github – Published: 2024-10-30 09:30 – Updated: 2026-04-01 18:32
VLAI
Details
Incorrect Privilege Assignment vulnerability in Matt Whiteman Bulk Change Role allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through 1.1.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-50504"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-30T08:15:03Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in Matt Whiteman Bulk Change Role allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through 1.1.",
"id": "GHSA-7gxr-vxj9-9x53",
"modified": "2026-04-01T18:32:14Z",
"published": "2024-10-30T09:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50504"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/bulk-role-change/vulnerability/wordpress-bulk-change-role-plugin-1-1-privilege-escalation-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/bulk-role-change/wordpress-bulk-change-role-plugin-1-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HCG-H92Q-PJ2J
Vulnerability from github – Published: 2025-08-28 15:30 – Updated: 2026-04-01 18:36
VLAI
Details
Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin allows Privilege Escalation. This issue affects Miraculous Core Plugin: from n/a through 2.0.7.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-49388"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-28T13:15:59Z",
"severity": "CRITICAL"
},
"details": "Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin allows Privilege Escalation. This issue affects Miraculous Core Plugin: from n/a through 2.0.7.",
"id": "GHSA-7hcg-h92q-pj2j",
"modified": "2026-04-01T18:36:00Z",
"published": "2025-08-28T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49388"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-7-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HJG-42GH-8J3V
Vulnerability from github – Published: 2026-01-14 09:31 – Updated: 2026-04-23 18:32
VLAI
Details
Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.
Severity
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-23550"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T09:16:02Z",
"severity": "CRITICAL"
},
"details": "Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.",
"id": "GHSA-7hjg-42gh-8j3v",
"modified": "2026-04-23T18:32:23Z",
"published": "2026-01-14T09:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550"
},
{
"type": "WEB",
"url": "https://help.modulards.com/en/article/modular-ds-security-release-modular-connector-252-dm3mv0"
},
{
"type": "WEB",
"url": "https://patchstack.com/articles/critical-privilege-escalation-vulnerability-in-modular-ds-plugin-affecting-40k-sites-exploited-in-the-wild"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HJQ-WMFX-V2H8
Vulnerability from github – Published: 2025-09-19 21:31 – Updated: 2025-09-19 21:31
VLAI
Details
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-26517"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-19T19:15:38Z",
"severity": "MODERATE"
},
"details": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades.",
"id": "GHSA-7hjq-wmfx-v2h8",
"modified": "2025-09-19T21:31:17Z",
"published": "2025-09-19T21:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26517"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/NTAP-20250910-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.