CWE-280 · Access Control
Improper Handling of Insufficient Permissions or Privileges
204CVEs
SortMost likely exploited
204 CVEs with CWE-280 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-29748In CISA KEVExploitedthere is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…Google · Android · CVSS 7.8 · 2024-04-05 | 7.8 | 0.7% | 2024-04-05 |
| CVE-2024-24116CheckRuijie RG-NBS2009G-P - Improper AuthenticationRuijie · Rg-Nbs2009g-P Firmware · CVSS 9.8 · 2024-10-02 | 9.8 | 28% | 2024-10-02 |
| CVE-2026-20817Windows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 21H2 · CVSS 7.8 · 2026-01-13 | 7.8 | 5.4% | 2026-01-13 |
| CVE-2020-8219An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.Ivanti · Pulse Connect Secure · 2020-07-30 | – | 2.2% | 2020-07-30 |
| CVE-2012-4550Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypassRed Hat · Red Hat JBoss Enterprise Application Platform 6.0 · CVSS 5.3 · 2013-01-05 | 5.3 | 2.1% | 2013-01-05 |
| CVE-2020-26195Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated…Dell · PowerScale OneFS · CVSS 5.3 · 2021-02-09 | 5.3 | 1.8% | 2021-02-09 |
| CVE-2019-6570A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that requi…Siemens · SINEMA Remote Connect Server · 2019-04-17 | – | 1.3% | 2019-04-17 |
| CVE-2023-42931The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin privileges without pr…Apple · macOS · CVSS 8.3 · 2024-03-28 | 8.3 | 1.2% | 2024-03-28 |
| CVE-2022-2193Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via pa…HYPR · HYPR Server · CVSS 7.5 · 2022-07-19 | 7.5 | 1.0% | 2022-07-19 |
| CVE-2019-13415Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.floragunn · Search Guard · 2019-08-13 | – | 1.0% | 2019-08-13 |
| CVE-2026-2340Samba: vfs_worm does not block directory modificationRed Hat · Red Hat Enterprise Linux 10 · CVSS 6.5 · 2026-05-27 | 6.5 | 0.9% | 2026-05-27 |
| CVE-2025-29826Microsoft Dataverse Elevation of Privilege VulnerabilityMicrosoft · Microsoft Dataverse · CVSS 7.3 · 2025-05-13 | 7.3 | 0.9% | 2025-05-13 |
| CVE-2020-29031Insecure Direct Object Reference in GateManager WebUI can cause privilege escalationSecomea · GateManager · CVSS 7.1 · 2021-02-15 | 7.1 | 0.8% | 2021-02-15 |
| CVE-2021-37175A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1),…Siemens · RUGGEDCOM ROX MX5000 · 2021-09-14 | – | 0.8% | 2021-09-14 |
| CVE-2022-4863Improper Handling of Insufficient Permissions or Privileges in usememos/memosusememos · usememos/memos · CVSS 8.4 · 2022-12-30 | 8.4 | 0.7% | 2022-12-30 |
| CVE-2020-8117Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.Nextcloud · Nextcloud Server · 2020-02-04 | – | 0.7% | 2020-02-04 |
| CVE-2024-25108Insufficient authorization allowing elevated access to resources in pixelfedpixelfed · pixelfed · CVSS 9.9 · 2024-02-12 | 9.9 | 0.7% | 2024-02-12 |
| CVE-2023-42578Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote attackers to access location information wi…Samsung Mobile · Samsung Data Store · CVSS 6.5 · 2023-12-05 | 6.5 | 0.7% | 2023-12-05 |
| CVE-2024-22078An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script…Elspec-Ltd · G5dfr Firmware · CVSS 8.8 · 2024-03-20 | 8.8 | 0.6% | 2024-03-20 |
| CVE-2023-27087Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.Xuxueli · Xxl-Job · CVSS 7.5 · 2023-03-21 | 7.5 | 0.6% | 2023-03-21 |
| CVE-2026-40371Microsoft Dynamics 365 (on-premises) Elevation of Privilege VulnerabilityMicrosoft · Microsoft Dynamics 365 (on-premises) version 9.1 · CVSS 8.8 · 2026-06-09 | 8.8 | 0.6% | 2026-06-09 |
| CVE-2025-27025Improper File Access in Infinera G42Infinera · G42 · CVSS 8.8 · 2025-07-02 | 8.8 | 0.6% | 2025-07-02 |
| CVE-2026-73239Apache Allura: Missing permission checks IDORApache Software Foundation · Apache Allura · CVSS 6.5 · 2026-08-12 | 6.5 | 0.6% | 2026-08-12 |
| CVE-2024-6660BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitr…reputeinfosystems · Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress · CVSS 8.8 · 2024-07-17 | 8.8 | 0.6% | 2024-07-17 |
| CVE-2023-43087Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerabili…Dell · PowerScale OneFS · CVSS 4.3 · 2023-11-02 | 4.3 | 0.6% | 2023-11-02 |
| CVE-2024-36451Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session…Webmin · Webmin · CVSS 8.8 · 2024-07-10 | 8.8 | 0.6% | 2024-07-10 |
| CVE-2024-25844An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain…Common-Services · So Flexibilite · CVSS 7.5 · 2024-03-03 | 7.5 | 0.5% | 2024-03-03 |
| CVE-2024-29852Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.Veeam · Backup & Replication · CVSS 2.7 · 2024-05-22 | 2.7 | 0.5% | 2024-05-22 |
| CVE-2025-6573GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/OverwriteImagination Technologies · Graphics DDK · CVSS 9.8 · 2025-08-08 | 9.8 | 0.5% | 2025-08-08 |
| CVE-2023-6189Improper Permission Handling in M-Files ServerM-Files · M-Files Server · CVSS 4.3 · 2023-11-22 | 4.3 | 0.5% | 2023-11-22 |
| CVE-2024-47766Permissions are incorrectly verified for project administrators in the cross tracker search widgetEnalean · tuleap · CVSS 4.9 · 2024-10-14 | 4.9 | 0.5% | 2024-10-14 |
| CVE-2024-39691Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access tomatrix-org · matrix-appservice-irc · CVSS 4.3 · 2024-07-05 | 4.3 | 0.5% | 2024-07-05 |
| CVE-2024-0560Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versionsRedhat · APIcast · CVSS 6.3 · 2024-02-28 | 6.3 | 0.5% | 2024-02-28 |
| CVE-2025-49731Microsoft Teams Elevation of Privilege VulnerabilityMicrosoft · Microsoft Teams for Android · CVSS 3.1 · 2025-07-08 | 3.1 | 0.5% | 2025-07-08 |
| CVE-2024-32882Permission check bypass when editing a model with per-field restrictions in wagtailwagtail · wagtail · CVSS 2.7 · 2024-05-02 | 2.7 | 0.5% | 2024-05-02 |
| CVE-2024-22077An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions.Elspec-Ltd · G5dfr Firmware · CVSS 5.3 · 2024-03-20 | 5.3 | 0.5% | 2024-03-20 |
| CVE-2025-8109GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operationImagination Technologies · Graphics DDK · CVSS 8.8 · 2025-08-04 | 8.8 | 0.5% | 2025-08-04 |
| CVE-2024-1608OPPO Usercenter Credit sdkOPPO · Usercenter Credit sdk · CVSS 9.1 · 2024-02-20 | 9.1 | 0.5% | 2024-02-20 |
| CVE-2026-62393Apache Kylin: Improper authorization in job information retrievalApache Software Foundation · Apache Kylin · CVSS 4.3 · 2026-07-14 | 4.3 | 0.5% | 2026-07-14 |
| CVE-2024-32000Truncated content of messages can be leaked from matrix-appservice-ircmatrix-org · matrix-appservice-irc · CVSS 4.3 · 2024-04-12 | 4.3 | 0.5% | 2024-04-12 |
| CVE-2023-38298Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on the device without a…No vendor recorded · CVSS 8.8 · 2024-04-22 | 8.8 | 0.5% | 2024-04-22 |
| CVE-2026-18860Velociraptor incorrect Org deletion permissions checkRapid7 · Velociraptor · CVSS 8.7 · 2026-08-11 | 8.7 | 0.4% | 2026-08-11 |
| CVE-2024-47767Tuleap lists trackers in the quick add actions of the backlog without any permissions checkEnalean · tuleap · CVSS 4.3 · 2024-10-14 | 4.3 | 0.4% | 2024-10-14 |
| CVE-2026-63792Gitea private reusable workflow disclosure to fork runsGitea · Gitea · CVSS 5.3 · 2026-10-14 | 5.3 | 0.4% | 2026-10-14 |
| CVE-2025-50170Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.8 · 2025-08-12 | 7.8 | 0.4% | 2025-08-12 |
| CVE-2025-67848Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.Moodle · Moodle · CVSS 8.1 · 2026-02-03 | 8.1 | 0.4% | 2026-02-03 |
| CVE-2023-2020Unauthorized scheduling of downtimes via REST APITribe29 · Checkmk · CVSS 4.3 · 2023-04-18 | 4.3 | 0.4% | 2023-04-18 |
| CVE-2022-34368Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. Authenticated non adm…Dell · NetWorker Management Console · CVSS 6.1 · 2022-08-30 | 6.1 | 0.4% | 2022-08-30 |
| CVE-2024-46874Ruijie Reyee OS Improper Handling of Insufficient Permissions or PrivilegesRuijie · Reyee OS · CVSS 8.1 · 2024-12-06 | 8.1 | 0.4% | 2024-12-06 |
| CVE-2024-36112Nautobot dynamic-group-members doesn't enforce permission restrictions on member objectsnautobot · nautobot · CVSS 6.3 · 2024-05-28 | 6.3 | 0.4% | 2024-05-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.