CWE-267 · Access Control
Privilege Defined With Unsafe Actions
73CVEs
SortMost likely exploited
73 CVEs with CWE-267 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-41244In CISA KEVExploitedVMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)VMware · VCF operations · CVSS 7.8 · 2025-09-29 | 7.8 | 16% | 2025-09-29 |
| CVE-2025-47811In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several…wftpserver · Wing FTP Server · CVSS 4.1 · 2025-07-10 | 4.1 | 6.2% | 2025-07-10 |
| CVE-2024-42365Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplanasterisk · asterisk · CVSS 7.4 · 2024-08-08 | 7.4 | 4.7% | 2024-08-08 |
| CVE-2020-29396A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute a…Odoo · Odoo Community · CVSS 9.9 · 2020-12-22 | 9.9 | 3.1% | 2020-12-22 |
| CVE-2019-10169A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permi…Redhat · keycloak · CVSS 6.6 · 2020-05-08 | 6.6 | 1.3% | 2020-05-08 |
| CVE-2025-53900Kiteworks MFT has a Privilege Defined With Unsafe Actionskiteworks · security-advisories · CVSS 6.5 · 2025-11-29 | 6.5 | 1.2% | 2025-11-29 |
| CVE-2019-10170A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated use…Redhat · keycloak · CVSS 6.6 · 2020-05-08 | 6.6 | 1.2% | 2020-05-08 |
| CVE-2021-32739Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesIcinga · icinga2 · CVSS 8.8 · 2021-07-15 | 8.8 | 1.1% | 2021-07-15 |
| CVE-2024-55968An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwar…No vendor recorded · CVSS 8.8 · 2025-01-28 | 8.8 | 1.0% | 2025-01-28 |
| CVE-2020-7824Ericssonlg iPECS Privilege Escalation VulnerabilityEricsson-LG · iPCES UCM · CVSS 6.5 · 2020-08-25 | 6.5 | 1.0% | 2020-08-25 |
| CVE-2025-23015Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actionsApache Software Foundation · Apache Cassandra · CVSS 8.8 · 2025-02-04 | 8.8 | 1.0% | 2025-02-04 |
| CVE-2023-2983Privilege Defined With Unsafe Actions in pimcore/pimcorepimcore · pimcore/pimcore · CVSS 6.5 · 2023-05-30 | 6.5 | 0.9% | 2023-05-30 |
| CVE-2026-18951Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterroleRed Hat · Red Hat OpenShift AI 3.3 · CVSS 8.8 · 2026-08-10 | 8.8 | 0.9% | 2026-08-10 |
| CVE-2023-41966Sielco Radio Link and Analog FM Transmitters Privilege Defined With Unsafe ActionsSielco · Analog FM transmitter · CVSS 6.5 · 2023-10-26 | 6.5 | 0.8% | 2023-10-26 |
| CVE-2023-22647An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster,…SUSE · Rancher · CVSS 9.9 · 2023-06-01 | 9.9 | 0.7% | 2023-06-01 |
| CVE-2021-44547A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.Odoo · Odoo Community · CVSS 8.7 · 2023-04-25 | 8.7 | 0.7% | 2023-04-25 |
| CVE-2021-23186A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tena…Odoo · Odoo Community · CVSS 8.7 · 2023-04-25 | 8.7 | 0.6% | 2023-04-25 |
| CVE-2021-23166A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.Odoo · Odoo Community · CVSS 8.7 · 2023-04-25 | 8.7 | 0.6% | 2023-04-25 |
| CVE-2023-32457Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. A remote attacker with low privileges could potentially exploit this vuln…Dell · PowerScale OneFS · CVSS 7.5 · 2023-08-29 | 7.5 | 0.6% | 2023-08-29 |
| CVE-2021-40354A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamc…Siemens · Teamcenter V12.4 · 2021-09-14 | – | 0.6% | 2021-09-14 |
| CVE-2026-10090Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application…Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 · CVSS 9 · 2026-08-05 | 9.0 | 0.6% | 2026-08-05 |
| CVE-2022-38124Unwanted debug toolSecomea · SiteManager · CVSS 5.7 · 2022-12-13 | 5.7 | 0.5% | 2022-12-13 |
| CVE-2023-43746BIG-IP Appliance mode external monitor vulnerabilityF5 · BIG-IP · CVSS 8.7 · 2023-10-10 | 8.7 | 0.5% | 2023-10-10 |
| CVE-2024-8631Privilege Defined With Unsafe Actions in GitLabGitLab · GitLab · CVSS 5.5 · 2024-09-12 | 5.5 | 0.5% | 2024-09-12 |
| CVE-2025-26467Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)Apache Software Foundation · Apache Cassandra · CVSS 8.8 · 2025-08-25 | 8.8 | 0.5% | 2025-08-25 |
| CVE-2021-44476A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensiti…Odoo · Odoo Community · CVSS 6.8 · 2023-04-25 | 6.8 | 0.5% | 2023-04-25 |
| CVE-2026-57202Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writesasterisk · asterisk · CVSS 8.1 · 2026-10-27 | 8.1 | 0.4% | 2026-10-27 |
| CVE-2025-7030Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085Drupal · Two-factor Authentication (TFA) · CVSS 6.5 · 2025-07-08 | 6.5 | 0.4% | 2025-07-08 |
| CVE-2023-27895Information Disclosure vulnerability in SAP Authenticator for AndroidSAP · Authenticator for Android · CVSS 6.1 · 2023-03-14 | 6.1 | 0.4% | 2023-03-14 |
| CVE-2025-14349Business Logic Error in Universal Software's FlexCity/KioskUniversal Software Inc. · FlexCity/Kiosk · CVSS 8.8 · 2026-02-13 | 8.8 | 0.4% | 2026-02-13 |
| CVE-2025-7691Privilege Defined With Unsafe Actions in GitLabGitLab · GitLab · CVSS 6.5 · 2025-09-26 | 6.5 | 0.4% | 2025-09-26 |
| CVE-2026-2459A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.Hitachi Energy · Relion REB500 · CVSS 7.4 · 2026-02-24 | 7.4 | 0.4% | 2026-02-24 |
| CVE-2026-29646In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled inc…No vendor recorded · CVSS 9.8 · 2026-04-20 | 9.8 | 0.4% | 2026-04-20 |
| CVE-2025-36255DS8900F and DS8A00 Privilege EscalationIBM · DS8A00( R10.0 - R10.1 ) · CVSS 7.5 · 2026-08-19 | 7.5 | 0.4% | 2026-08-19 |
| CVE-2026-96659Foreman: excessive permissions for viewer role on previewRed Hat · Red Hat Satellite 6.16 for RHEL 8 · CVSS 9.1 · 2026-10-01 | 9.1 | 0.3% | 2026-10-01 |
| CVE-2025-61754Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0. Easily exploit…Oracle Corporation · Oracle BI Publisher · CVSS 6.5 · 2025-10-21 | 6.5 | 0.3% | 2025-10-21 |
| CVE-2019-14865A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configu…Gnu · grub2 · CVSS 5.9 · 2019-11-29 | 5.9 | 0.3% | 2019-11-29 |
| CVE-2026-6816TFA Basic Plugins - Access BypassDrupal · TFA Basic Plugins · CVSS 5.1 · 2026-05-28 | 5.1 | 0.3% | 2026-05-28 |
| CVE-2026-114524Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225Drupal · Custom Formatters · CVSS 7.2 · 2026-10-30 | 7.2 | 0.3% | 2026-10-30 |
| CVE-2026-2460A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not…Hitachi Energy · Relion REB500 · CVSS 7.6 · 2026-02-24 | 7.6 | 0.3% | 2026-02-24 |
| CVE-2025-62289Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easily exploitable vulnera…Oracle Corporation · Oracle ZFS Storage Appliance Kit · CVSS 4.9 · 2025-10-21 | 4.9 | 0.3% | 2025-10-21 |
| CVE-2025-62288Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger). Supported versions that are affected are…Oracle Corporation · Oracle Health Sciences Data Management Workbench · CVSS 4.9 · 2025-10-21 | 4.9 | 0.3% | 2025-10-21 |
| CVE-2026-23526CVAT vulnerable to privilege escalation of users with staff statuscvat-ai · cvat · CVSS 8.5 · 2026-01-21 | 8.5 | 0.3% | 2026-01-21 |
| CVE-2025-62480Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that is affected is 8.8. Easily exploitable vu…Oracle Corporation · Oracle ZFS Storage Appliance Kit · CVSS 2.7 · 2025-10-21 | 2.7 | 0.3% | 2025-10-21 |
| CVE-2025-62479Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitable vulne…Oracle Corporation · Oracle ZFS Storage Appliance Kit · CVSS 2.7 · 2025-10-21 | 2.7 | 0.3% | 2025-10-21 |
| CVE-2026-12977Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalationRed Hat · Red Hat JBoss Enterprise Application Platform 8.1 · CVSS 8.8 · 2026-11-09 | 8.8 | 0.3% | 2026-11-09 |
| CVE-2017-2616A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other pr…Linux · util-linux · CVSS 5.5 · 2018-07-27 | 5.5 | 0.3% | 2018-07-27 |
| CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypassApache Software Foundation · Apache Cassandra · CVSS 8.8 · 2026-04-07 | 8.8 | 0.3% | 2026-04-07 |
| CVE-2024-7571Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.Ivanti · Secure Access Client · CVSS 7.8 · 2024-11-12 | 7.8 | 0.3% | 2024-11-12 |
| CVE-2026-96367Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162Drupal · Webform · CVSS 4.6 · 2026-10-22 | 4.6 | 0.3% | 2026-10-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.