CWE-269: Improper Privilege Management vulnerabilities

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

FreePBX backup versions prior to 17.0.11 contain a vulnerability in the publicKeySave AJAX endpoint that allows an authenticated administrator to append an SSH public key to the asterisk user's authorized_keys file without proper command restrictions. This grants persistent shell access with the ability to execute arbitrary commands, access sensitive data, modify system files, and disrupt services. The issue is fixed in version 17.0.11.

CVE-2026-18249 is a high-severity vulnerability in IBM i versions 7.3 through 7.6. It involves improper privilege management due to insufficient validation of pointers read from Java-controlled addresses, allowing a remote authenticated attacker to gain elevated privileges.

CVE-2026-18193 is a high severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses. This improper privilege management flaw can lead to a complete compromise of confidentiality and integrity, with limited impact on availability.

CVE-2026-18101 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper privilege management where a local attacker could gain elevated privileges due to incorrect handling of thread authority swaps. The vulnerability has a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet by IBM. There are no known exploits in the wild at this time.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.

CVE-2026-17074 is a low severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 where improper privilege management could allow a remote authenticated attacker to bypass security restrictions. The vulnerability does not impact confidentiality or availability but may allow limited integrity compromise. No official patch or remediation guidance is currently available from the vendor.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

CVE-2026-18071 is a high severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a local attacker to gain elevated privileges due to improper privilege management.

CVE-2026-24059 is a vulnerability in Gitea Open Source Git Server where a GET API endpoint that should be read-only actually creates a new runner registration token if none exists. This occurs because the API scope middleware incorrectly treats the GET request as read-only. An attacker with a leaked read:user-scoped token can exploit this to generate a registration token and register a malicious Actions runner, which can then execute workflow jobs with access to repository secrets and source code.

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

CVE-2026-68752 is a high-severity vulnerability in JFrog Artifactory where a Project Resource Manager can improperly gain broader administrative privileges under certain conditions. This flaw affects versions prior to 7.146.35 and allows privilege escalation. The issue is classified under CWE-269, indicating improper privilege management.