CWE-266 vulnerabilities

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace. This affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16 and potentially older versions.

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".

CVE-2026-84716 is a moderate severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 affecting the automation-controller's instance install-bundle endpoint. It allows a system administrator to obtain a long-lived, non-revocable X.509 certificate signed by the receptor mesh certificate authority by exploiting case sensitivity inconsistencies in hostname validation. This certificate can be used to impersonate or intercept TLS traffic within the receptor mesh in managed or hosted deployments. The flaw does not allow direct remote code execution.

CVE-2026-63349 is a privilege assignment vulnerability in AnyIO versions 4.14.0 up to but not including 4.14.2. The issue arises because anyio.open_process() incorrectly forwards the extra_groups argument, causing child processes to retain parent supplementary groups instead of properly clearing or setting them. This affects POSIX privilege dropping correctness in applications relying on AnyIO subprocess helpers. The flaw can also cause a TypeError if conflicting arguments are supplied.

CVE-2026-73461 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves incorrect privilege assignment in AAA-based gRPC authorization for OpenConfig, where authenticated users may receive incorrect privilege levels, causing authorization with the wrong AAA method list. This issue does not affect non-gRPC OpenConfig requests such as NETCONF.

CVE-2026-86830 is a high-severity vulnerability in AWS IAM Identity Center's Temporary Elevated Access Management (TEAM) solution prior to version 1.5.1. It involves incorrect privilege assignment that could allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests. This could lead to unintended temporary elevated access to AWS accounts managed through TEAM. The issue is fixed in version 1.5.1 and later.

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-software: before 1.0.5.

A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster.

Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file.  This issue affects Horizon Security Analyzer : A33.10, A33.20 and A33.30.

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

CVE-2026-81792 is an Incorrect Privilege Assignment vulnerability in the MultiVendorX Product Catalog Enquiry plugin for WooCommerce. It allows privilege escalation due to improper access control. The issue affects all versions from initial release up to 6.1.5 inclusive. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or vendor advisory is provided in the input data.

CVE-2026-86500 is a vulnerability in JetBrains YouTrack before version 2026.1.14047 where a missing escalation check allows a user with project update permissions to elevate their privileges to Project Admin. This flaw is categorized under CWE-266 (Incorrect Privilege Assignment). The vulnerability has a medium severity with a CVSS score of 5.5.

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.

Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.

Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1.