CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
2331 vulnerabilities reference this CWE, most recent first.
GHSA-G662-99Q6-PQQ7
Vulnerability from github – Published: 2025-08-27 06:30 – Updated: 2025-08-27 06:30Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authenticated local attacker may escalate privileges and execute an arbitrary command.
{
"affected": [],
"aliases": [
"CVE-2025-57797"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-27T06:15:30Z",
"severity": "HIGH"
},
"details": "Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authenticated local attacker may escalate privileges and execute an arbitrary command.",
"id": "GHSA-g662-99q6-pqq7",
"modified": "2025-08-27T06:30:27Z",
"published": "2025-08-27T06:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57797"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN69684540"
},
{
"type": "WEB",
"url": "https://www.pfu.ricoh.com/imaging/news/news20230606.html"
},
{
"type": "WEB",
"url": "https://www.pfu.ricoh.com/scansnap/software/sshome/requirement.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G67C-JG9C-RQH2
Vulnerability from github – Published: 2026-08-20 12:31 – Updated: 2026-09-28 12:31A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
{
"affected": [],
"aliases": [
"CVE-2026-11861"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T11:16:19Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.",
"id": "GHSA-g67c-jg9c-rqh2",
"modified": "2026-09-28T12:31:02Z",
"published": "2026-08-20T12:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11861"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:72279"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-11861"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487472"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G6P6-CJCX-6P6P
Vulnerability from github – Published: 2026-08-09 18:30 – Updated: 2026-08-09 18:30A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
{
"affected": [],
"aliases": [
"CVE-2026-19360"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-09T17:16:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.",
"id": "GHSA-g6p6-cjcx-6p6p",
"modified": "2026-08-09T18:30:26Z",
"published": "2026-08-09T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19360"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-19360"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/866026"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/387214"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/387214/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G78X-7VWX-9F58
Vulnerability from github – Published: 2026-02-02 06:30 – Updated: 2026-02-13 21:51A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.5.0"
},
{
"fixed": "26.5.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.4.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-13881"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T20:59:06Z",
"nvd_published_at": "2026-02-02T06:16:19Z",
"severity": "LOW"
},
"details": "A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.",
"id": "GHSA-g78x-7vwx-9f58",
"modified": "2026-02-13T21:51:17Z",
"published": "2026-02-02T06:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13881"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/45873"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/45427"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/1d7ab8d5fb1403902f5152820a8fc734d38b08d2"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/c5c83d6604d4c73139f38fce3ed7b7c4c38c09f2"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2365"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2366"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-13881"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418330"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes"
}
GHSA-G7C2-78MQ-V43G
Vulnerability from github – Published: 2024-10-29 12:30 – Updated: 2026-04-01 18:32Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through 6.5.1.
{
"affected": [],
"aliases": [
"CVE-2024-50550"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-29T10:15:04Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through 6.5.1.",
"id": "GHSA-g7c2-78mq-v43g",
"modified": "2026-04-01T18:32:12Z",
"published": "2024-10-29T12:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50550"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-6-5-1-privilege-escalation-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-5-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G7FX-R7WP-M8CX
Vulnerability from github – Published: 2025-12-25 21:30 – Updated: 2025-12-25 21:30A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-15085"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-25T20:15:41Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-g7fx-r7wp-m8cx",
"modified": "2025-12-25T21:30:11Z",
"published": "2025-12-25T21:30:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15085"
},
{
"type": "WEB",
"url": "https://github.com/Hwwg/cve/issues/26"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.338413"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.338413"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.708175"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G829-2387-H324
Vulnerability from github – Published: 2025-09-30 18:30 – Updated: 2025-12-24 15:30A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster's confidentiality, integrity, and availability. The attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, leading to a total breach of the platform and all applications hosted on it.
{
"affected": [],
"aliases": [
"CVE-2025-10725"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-30T18:15:47Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster\u0027s confidentiality, integrity, and availability. The attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, leading to a total breach of the platform and all applications hosted on it.",
"id": "GHSA-g829-2387-h324",
"modified": "2025-12-24T15:30:28Z",
"published": "2025-09-30T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10725"
},
{
"type": "WEB",
"url": "https://github.com/opendatahub-io/opendatahub-operator/pull/2571"
},
{
"type": "WEB",
"url": "https://github.com/opendatahub-io/opendatahub-operator/commit/070057ebd0882be0e397bee1daa18c36374a03c0"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2025:16983"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2025:16984"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:16981"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:16982"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:16983"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:16984"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17501"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-10725"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396641"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G88G-9J7X-57V4
Vulnerability from github – Published: 2025-07-14 00:31 – Updated: 2025-07-14 00:31A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northstar-main/src/main/java/org/dromara/northstar/web/interceptor/AuthorizationInterceptor.java of the component Path Handler. The manipulation of the argument Request leads to improper access controls. The attack may be launched remotely. Upgrading to version 7.3.6 is able to address this issue. The patch is identified as 8d521bbf531de59b09b8629a9cbf667870ad2541. It is recommended to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2025-7552"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-14T00:15:25Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Dromara Northstar up to 7.3.5. It has been rated as critical. Affected by this issue is the function preHandle of the file northstar-main/src/main/java/org/dromara/northstar/web/interceptor/AuthorizationInterceptor.java of the component Path Handler. The manipulation of the argument Request leads to improper access controls. The attack may be launched remotely. Upgrading to version 7.3.6 is able to address this issue. The patch is identified as 8d521bbf531de59b09b8629a9cbf667870ad2541. It is recommended to upgrade the affected component.",
"id": "GHSA-g88g-9j7x-57v4",
"modified": "2025-07-14T00:31:07Z",
"published": "2025-07-14T00:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7552"
},
{
"type": "WEB",
"url": "https://gitee.com/dromara/northstar/commit/8d521bbf531de59b09b8629a9cbf667870ad2541"
},
{
"type": "WEB",
"url": "https://gitee.com/dromara/northstar/issues/ICCQ4E"
},
{
"type": "WEB",
"url": "https://gitee.com/dromara/northstar/issues/ICCQ4E#note_42855013_link"
},
{
"type": "WEB",
"url": "https://gitee.com/dromara/northstar/releases/tag/v7.3.6"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.316250"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.316250"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G8QW-MGJX-RWJR
Vulnerability from github – Published: 2025-06-16 16:01 – Updated: 2025-06-17 19:26Impact
When an authd user logs in via SSH for the first time (meaning they do not yet exist in the authd user database) and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user to read and write files that are accessible by the root group, to which they should not have access. The user does not get root privileges or any capabilities beyond the access granted to the root group.
Preconditions under which this vulnerability affects a system
* authd was installed via the PPA.
* An OAuth 2.0 application was registered in Microsoft Entra ID or Google IAM, and the respective authd broker was installed (authd-msentraid or authd-google) and configured.
* sshd was configured to enable SSH access with authd, i.e.:
UsePAM yes
KbdInteractiveAuthentication yes
* The username is allowed by the ssh_allowed_suffixes option in the broker configuriation.
* The user is allowed by the allowed_users option in the broker configuration.
* The user successfully authenticates via the authd broker (Entra ID or Google IAM).
* The user did not log in locally before.
Patches
Fixed by https://github.com/ubuntu/authd/commit/619ce8e55953b970f1765ddaad565081538151ab
Workarounds
Configure the SSH server to not allow authenticating via authd, for example by setting UsePAM no or KbdInteractiveAuthentication no in the sshd_config (see https://documentation.ubuntu.com/authd/stable/howto/login-ssh/#ssh-configuration).
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ubuntu/authd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-5689"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-16T16:01:10Z",
"nvd_published_at": "2025-06-16T12:15:19Z",
"severity": "MODERATE"
},
"details": "### Impact\nWhen an authd user logs in via SSH for the first time (meaning they do not yet exist in the authd user database) and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user to read and write files that are accessible by the root group, to which they should not have access. The user does not get root privileges or any capabilities beyond the access granted to the root group.\n\n**Preconditions under which this vulnerability affects a system**\n* authd was [installed via the PPA](https://documentation.ubuntu.com/authd/latest/howto/install-authd/#install-authd).\n* An OAuth 2.0 application was registered in Microsoft Entra ID or Google IAM, and the respective authd broker was installed ([authd-msentraid](https://snapcraft.io/authd-msentraid) or [authd-google](https://snapcraft.io/authd-google)) and [configured](https://documentation.ubuntu.com/authd/latest/howto/configure-authd/#broker-configuration).\n* sshd was [configured to enable SSH](https://documentation.ubuntu.com/authd/latest/howto/login-ssh/) access with authd, i.e.:\n ```\n UsePAM yes\n KbdInteractiveAuthentication yes\n ```\n* The username is allowed by the `ssh_allowed_suffixes` option in the [broker configuriation](https://documentation.ubuntu.com/authd/latest/howto/login-ssh/#broker-configuration).\n* The user is allowed by the [`allowed_users` option in the broker configuration](https://documentation.ubuntu.com/authd/latest/howto/configure-authd/#configure-allowed-users).\n* The user successfully authenticates via the authd broker (Entra ID or Google IAM).\n* The user did not log in locally before.\n\n### Patches\nFixed by https://github.com/ubuntu/authd/commit/619ce8e55953b970f1765ddaad565081538151ab\n\n### Workarounds\nConfigure the SSH server to not allow authenticating via authd, for example by setting `UsePAM no` or `KbdInteractiveAuthentication no` in the `sshd_config` (see https://documentation.ubuntu.com/authd/stable/howto/login-ssh/#ssh-configuration).",
"id": "GHSA-g8qw-mgjx-rwjr",
"modified": "2025-06-17T19:26:35Z",
"published": "2025-06-16T16:01:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ubuntu/authd/security/advisories/GHSA-g8qw-mgjx-rwjr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5689"
},
{
"type": "WEB",
"url": "https://github.com/ubuntu/authd/commit/619ce8e55953b970f1765ddaad565081538151ab"
},
{
"type": "PACKAGE",
"url": "https://github.com/ubuntu/authd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "New authd users logging in via SSH are members of the root group"
}
GHSA-G989-9GJV-RRFG
Vulnerability from github – Published: 2025-02-12 12:30 – Updated: 2025-02-12 12:30The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.76. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable sites.
{
"affected": [],
"aliases": [
"CVE-2024-12213"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T10:15:08Z",
"severity": "CRITICAL"
},
"details": "The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.76. This is due to the plugin allowing a user to supply the \u0027role\u0027 field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable sites.",
"id": "GHSA-g989-9gjv-rrfg",
"modified": "2025-02-12T12:30:46Z",
"published": "2025-02-12T12:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12213"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/superio-job-board-wordpress-theme/32180231"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cdfce88-b6c2-4820-9d6f-446f61b9b596?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.