CWE-266 vulnerabilities

Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0.

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

CVE-2026-8752 is a medium severity vulnerability in h2oai h2o-3 version 7402 that involves improper access controls in the Rapids setproperty Primitive Handler component. The issue exists in the exec function of the file AstSetProperty.java. This vulnerability can be exploited remotely without authentication or user interaction. Although a public exploit is available, there is no vendor response or patch at this time. The vulnerability could allow unauthorized manipulation due to improper access control enforcement.

Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs in. It is possible for a local attacker who controls the client process to dump it's memory, extract credentials and use them to gain a privileged access to the database. In order to exploit this vulnerability, the client application has to be already configured, but a user does not have to be logged in.  This issue has been fixed in version 2026.4

An authenticated iControl SOAP user may be able to obtain information of other accounts.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

CVE-2026-44997 is a security vulnerability in OpenClaw versions before 2026.4.22. It allows restricted subagents to spawn ACP child sessions that do not inherit important security constraints such as depth, child-count limits, control scope, or target-agent restrictions. This flaw can be exploited to bypass subagent-only restrictions, potentially leading to privilege escalation or unauthorized access to restricted resources. The vulnerability has a low CVSS score of 2.3 and does not have known exploits in the wild. No patch or fix information is provided in the available data.

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS. Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.

CVE-2026-8148 is a high-severity vulnerability in NAVER MYBOX Explorer for Windows versions before 3.0.11.160. It allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by exploiting improper privilege checks related to registry manipulation. The vulnerability is classified under CWE-266, indicating incorrect privilege assignment. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30.

OpenClaw before version 2026.4.14 has an authorization context reuse vulnerability in its collect-mode queue batches. This flaw allows messages from different senders to inherit the authorization context of the final sender, enabling attackers to execute earlier messages with elevated privileges by sending multiple queued messages. The vulnerability is identified as CWE-266 Incorrect Privilege Assignment and has a CVSS 4.0 score of 7.6, indicating high severity.

A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3.

CVE-2026-22337 is a critical vulnerability in the Directorist Social Login plugin caused by incorrect privilege assignment, allowing privilege escalation. It affects versions before 2.1.4. The vulnerability has a high CVSS score of 9.8, indicating it can be exploited remotely without user interaction to fully compromise confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.

An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.

A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access to any device group at any access level.

CVE-2026-21011 is a medium severity vulnerability in Samsung Mobile Devices involving incorrect privilege assignment in Bluetooth during Maintenance mode. This flaw allows physical attackers to bypass the Extend Unlock security feature. The vulnerability is identified as CWE-266, indicating improper privilege management. It affects devices prior to the SMR April 2026 Release 1. There is no official patch or remediation level provided yet, and no known exploits in the wild have been reported.