CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5455 vulnerabilities reference this CWE, most recent first.
GHSA-RWR4-4F3W-P582
Vulnerability from github – Published: 2025-12-06 06:30 – Updated: 2026-01-30 21:30A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations.
Apigee-X was found to be vulnerable.
This vulnerability was patched in version 1-16-0-apigee-3. No user action is required for this.
{
"affected": [],
"aliases": [
"CVE-2025-13292"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-06T05:16:44Z",
"severity": "HIGH"
},
"details": "A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations.\n\nApigee-X was found to be vulnerable.\n\nThis vulnerability was patched in version\u00a01-16-0-apigee-3.\u00a0No user action is required for this.",
"id": "GHSA-rwr4-4f3w-p582",
"modified": "2026-01-30T21:30:19Z",
"published": "2025-12-06T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13292"
},
{
"type": "WEB",
"url": "https://docs.cloud.google.com/apigee/docs/release-notes#October_16_2025"
},
{
"type": "WEB",
"url": "https://focalsecurity.io/blog/gatewaytoheaven-gcp-cross-tenant-vulnerability"
},
{
"type": "WEB",
"url": "https://omeramiad.com/posts/gatewaytoheaven-gcp-cross-tenant-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-RWVG-WFJ8-F23J
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2022-05-13 01:46Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2017-5703"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-03T21:29:00Z",
"severity": "MODERATE"
},
"details": "Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.",
"id": "GHSA-rwvg-wfj8-f23j",
"modified": "2022-05-13T01:46:16Z",
"published": "2022-05-13T01:46:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5703"
},
{
"type": "WEB",
"url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00087\u0026languageid=en-fr"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180924-0004"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03867en_us"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040626"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RWVJ-JGC4-FQQ5
Vulnerability from github – Published: 2019-02-18 23:34 – Updated: 2021-01-08 01:57Affected versions of cobalt-cli insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running cobalt-cli.
Recommendation
No patch is currently available for this vulnerability.
The best mitigation is currently to avoid using this package, using a different package if available.
Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "cobalt-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.5.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10597"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-311"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:56:17Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of `cobalt-cli` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cobalt-cli`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability.\n\nThe best mitigation is currently to avoid using this package, using a different package if available. \n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
"id": "GHSA-rwvj-jgc4-fqq5",
"modified": "2021-01-08T01:57:44Z",
"published": "2019-02-18T23:34:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10597"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-rwvj-jgc4-fqq5"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/197"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Downloads Resources over HTTP in cobalt-cli"
}
GHSA-RX3C-36RQ-FGF8
Vulnerability from github – Published: 2026-05-21 12:31 – Updated: 2026-05-21 18:33In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected.
In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process.
{
"affected": [],
"aliases": [
"CVE-2026-45254"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-21T10:16:26Z",
"severity": "MODERATE"
},
"details": "In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as \"allow any\" instead of being rejected.\n\nIn certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process.",
"id": "GHSA-rx3c-36rq-fgf8",
"modified": "2026-05-21T18:33:08Z",
"published": "2026-05-21T12:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45254"
},
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:24.cap_net.asc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RXHF-H39P-VQ9J
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.
{
"affected": [],
"aliases": [
"CVE-2020-1264"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-09T20:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka \u0027Windows Kernel Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.",
"id": "GHSA-rxhf-h39p-vq9j",
"modified": "2022-05-24T17:19:54Z",
"published": "2022-05-24T17:19:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1264"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1264"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RXHW-86VX-3H5P
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions was not trapped.
{
"affected": [],
"aliases": [
"CVE-2020-7467"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-26T21:15:00Z",
"severity": "HIGH"
},
"details": "In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions was not trapped.",
"id": "GHSA-rxhw-86vx-3h5p",
"modified": "2022-05-24T17:45:31Z",
"published": "2022-05-24T17:45:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7467"
},
{
"type": "WEB",
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:29.bhyve_svm.asc"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RXJG-QV62-7H6C
Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23An elevation of privilege vulnerability exists when the Windows Delivery Optimization service improperly handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1388, CVE-2020-1394, CVE-2020-1395.
{
"affected": [],
"aliases": [
"CVE-2020-1392"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists when the Windows Delivery Optimization service improperly handles objects in memory, aka \u0027Windows Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1388, CVE-2020-1394, CVE-2020-1395.",
"id": "GHSA-rxjg-qv62-7h6c",
"modified": "2022-05-24T17:23:03Z",
"published": "2022-05-24T17:23:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1392"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1392"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RXM5-9Q2G-4C8R
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.
{
"affected": [],
"aliases": [
"CVE-2020-27519"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-30T14:15:00Z",
"severity": "HIGH"
},
"details": "Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.",
"id": "GHSA-rxm5-9q2g-4c8r",
"modified": "2022-05-24T17:49:19Z",
"published": "2022-05-24T17:49:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27519"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/commit/87ceeae9b8ee415541d7d71de10675e699a76e5e"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/commit/87ceeae9b8ee415541d7d71de10675e699a76e5e#diff-5c6a264bee3576f2a147b8db70332e9a16dd43d073782cf6d32a372abb22b899"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/commit/c0aeb159351e5e99d752c27b87133eca299bdfce"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RXPX-844R-F443
Vulnerability from github – Published: 2024-07-12 15:31 – Updated: 2026-04-01 18:31Improper Privilege Management vulnerability in NooTheme Jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through 4.7.0.
{
"affected": [],
"aliases": [
"CVE-2024-37927"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-12T14:15:13Z",
"severity": "CRITICAL"
},
"details": "Improper Privilege Management vulnerability in NooTheme Jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through 4.7.0.",
"id": "GHSA-rxpx-844r-f443",
"modified": "2026-04-01T18:31:52Z",
"published": "2024-07-12T15:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37927"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-7-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/noo-jobmonster/wordpress-jobmonster-theme-4-7-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXVX-2JQ5-PC48
Vulnerability from github – Published: 2021-12-16 00:01 – Updated: 2022-05-24 00:00Windows Installer Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2021-43883"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-15T15:15:00Z",
"severity": "HIGH"
},
"details": "Windows Installer Elevation of Privilege Vulnerability",
"id": "GHSA-rxvx-2jq5-pc48",
"modified": "2022-05-24T00:00:39Z",
"published": "2021-12-16T00:01:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43883"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43883"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.