CWE-266 Incorrect Privilege Assignment

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

LiteLLM: Admin Key Handler Has Improper Authorization

LiteLLM: M2M JWT Handler Has Improper Authorization

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

zilliztech deep-searcher has an Incorrect Privilege Assignment issue

Gitea LFS Deploy-Key Privilege Escalation

Memos has an Incorrect Privilege Assignment issue

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API

OpenStack Keystone has an Incorrect Authorization issue

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

Keycloak has privilege escalation via improper scope mapping enforcement

Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement

OpenClaw: Active Memory write scope could mutate global config

Duplicate Advisory: Active Memory write scope could mutate global config

Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes

Decidim amendments can be accepted or rejected by anyone

phpMyFAQ: IDOR Account Takeover

Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints