The Redux Framework WordPress plugin up to version 4.5.11 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit insufficient capability checks to set arbitrary user roles, including Administrator, during profile updates if a plugin or theme uses certain Redux user profile fields. This vulnerability arises from saving arbitrary meta keys under a registered option without proper restrictions.
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.
IBM Guardium Data Protection version 12.2 contains a local privilege escalation vulnerability in the cp_wrapper component. This flaw allows a low-privileged local user to gain root privileges, potentially enabling unauthorized access or modification of sensitive system files. The vulnerability is classified under improper privilege management (CWE-269).
CVE-2026-50054 is an authorization vulnerability in Zimbra Collaboration Suite affecting versions before 10.1.20. It allows an authenticated attacker to grant another local account the loginAs right, enabling persistent mailbox access and mail-sending capabilities that persist beyond password changes and session expirations. The vulnerability has a high severity with a CVSS score of 7.1.
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.
An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 contain an improper privilege management vulnerability in the ContainerStorageModule Custom Resource reconciler. This flaw allows a low privileged remote attacker to escalate privileges and gain root-level access on cluster nodes. The vulnerability is critical with a CVSS score of 9.9.
A privilege management vulnerability in TryGhost Ghost allows staff users with Editor or Super Editor roles to assign their own role to Author and Contributor users, despite lacking permission to do so. This issue affects Ghost versions from 0.5.0 up to but not including 6.64.0. The vulnerability has a medium severity with a CVSS score of 4.3. Version 6.64.0 contains a fix that addresses this issue.
CVE-2026-105634 is a privilege management vulnerability in the open-source project management tool Plane. Versions prior to 1.3.0 allow any project member, including those with the lowest GUEST role, to modify other project members' roles. Although the system prevents assigning roles higher than the requester's, it does not prevent assigning equal or lower roles, enabling a Guest user to demote Administrators and Members, potentially disrupting project control. This issue is fixed in version 1.3.0.
Plane, an open-source project management tool, has a privilege management vulnerability prior to version 1.4.0. A Project Member with role 15 can exploit insufficient validation in the project-member update API endpoint to promote a Project Guest (role 5) to Member without requiring Project Admin approval. This unauthorized role escalation grants additional project capabilities and bypasses governance controls. The issue is fixed in version 1.4.0.
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.
The Divi Membership WordPress plugin versions up to 2.2.0 contain a critical privilege escalation vulnerability. An unauthenticated attacker can exploit improper privilege management in the user registration process to create a new account with administrator privileges. This is achieved by submitting a specially crafted bcrypt hash of the 'administrator' role in the form_id POST parameter. The vulnerability requires a WordPress nonce, which is publicly available on pages rendering the registration form, allowing any visitor to exploit it and gain full site control.
The Super Forms – Drag & Drop Form Builder WordPress plugin contains a privilege escalation vulnerability in versions up to and including 6.3.316. This flaw allows authenticated users with Subscriber-level access or higher to overwrite credentials of arbitrary accounts, including administrators, by exploiting insufficient capability checks in the Register & Login add-on. Successful exploitation can lead to full site compromise.
CVE-2026-27872 is an improper privilege management vulnerability in Johnson Controls Easy IO FG affecting versions before 2.0b52. The flaw allows privilege escalation through brute force attacks. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.6.
CVE-2026-104018 is an improper privilege management vulnerability in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. This flaw allows an authenticated user with limited privileges to execute commands without the usual privilege checks, leading to privilege escalation. The vulnerability affects all versions of VxWorks 7 prior to 26.09 and has been fixed in version 26.09. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.