Home/CWE/Improper Privilege Management
Weakness

Improper Privilege Management

CWE-269 · Class · Draft

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-284 · Improper Access Control
Children (more specific)
ParentOfCWE-250 · Execution with Unnecessary Privileges
ParentOfCWE-266 · Incorrect Privilege Assignment
ParentOfCWE-267 · Privilege Defined With Unsafe Actions
ParentOfCWE-268 · Privilege Chaining
ParentOfCWE-270 · Privilege Context Switching Error
ParentOfCWE-271 · Privilege Dropping / Lowering Errors
ParentOfCWE-274 · Improper Handling of Insufficient Privileges
ParentOfCWE-648 · Incorrect Use of Privileged APIs
◆

Attack Patterns (CAPEC)

3
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-122Privilege Abuse
CAPEC-233Privilege Escalation
CAPEC-58Restful Privilege Elevation
⚠

CVEs With This Weakness

2,936
A sample of the 2,936 CVEs tagged with this weakness.
CVECVE-2026-8719
CVECVE-2026-8069
CVECVE-2026-7994
CVECVE-2026-7977
CVECVE-2026-7971
CVECVE-2026-7778
CVECVE-2026-7641
CVECVE-2026-7106
CVECVE-2026-6769
CVECVE-2026-6761
CVECVE-2026-6750
CVECVE-2026-6741
◉

Nuclei Scanner Templates

23
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalSimple User Registration <= 6.3 - Unauthenticated Privilege Escalation
criticalThe Opal Estate Pro - Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
criticalUser Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
criticalEventin <= 4.0.26 - Privilege Escalation
criticalMasterStudy LMS <2.7.6 - Improper Access Control
criticalLogin as User or Customer < 3.3 - Privilege Escalation
criticalOpen Web Analytics 1.7.3 - Remote Code Execution
criticalWordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation
criticalrConfig 3.9 - Authentication Bypass(Admin Login)
criticalUltimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
criticalNewspaper Theme 6.4-6.7.1 - Privilege Escalation
criticalApache Airflow - Unauthenticated Variable Import
criticalWordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness
criticalWordPress ProfilePress <= 3.1.3 - Privilege Escalation
criticalSonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation
criticalKramer VIAware - Privilege Escalation and Remote Code Execution
criticalApache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
criticalUltimate Member < 2.6.7 - Unauthenticated Privilege Escalation
criticalHT Mega - Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation
criticalMasteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation
criticalGhostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability
highProfilePress <= 4.13.1, Unauthenticated Privilege Escalation
mediumAkkadian Provisioning Manager - Information Disclosure
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin