CVE-2026-58611

Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.

Scoring

Severity

HIGH

CVSS base score

7.8

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-285

Published

2026-09-08

Last modified

2026-09-09

Affected products

• Microsoft Xbox Gaming Services

Weakness type

• CWE-285

Related vulnerabilities

• CVE-2026-86804 — seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
• CVE-2026-86277 — SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization
• CVE-2026-86263 — sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization
• CVE-2026-86262 — sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization
• CVE-2026-86261 — sfturing hosp_order Order Controller OrderController.java authorization
• CVE-2026-86283 — MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
• CVE-2026-86212 — Open5GS AMF/MME improper authorization
• CVE-2026-86183 — diem-project diem dmWidget BasedmWidgetActions.class.php authorization

Markdown version · Browse all CVEs