CWE-284

{
  "affected": [],
  "aliases": [
    "CVE-2026-28821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T01:17:07Z",
    "severity": "MODERATE"
  },
  "details": "A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain elevated privileges.",
  "id": "GHSA-7jx6-r36g-7pwq",
  "modified": "2026-03-25T21:30:28Z",
  "published": "2026-03-25T03:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28821"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126794"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126795"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126796"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-41298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-30T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user\u0027s privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.",
  "id": "GHSA-7jxv-2xpm-95jx",
  "modified": "2022-05-24T19:16:13Z",
  "published": "2022-05-24T19:16:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41298"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-7224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-11-10T06:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka \"VHD Driver Elevation of Privilege Vulnerability.\"",
  "id": "GHSA-7m2h-7xmj-fm47",
  "modified": "2025-04-12T13:06:24Z",
  "published": "2022-05-14T02:22:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7224"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-138"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/40765"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94017"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1037248"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/core-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.3.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/core-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.4.0-RC1"
            },
            {
              "fixed": "5.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/contao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.3.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/contao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.4.0-RC1"
            },
            {
              "fixed": "5.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-28T14:40:45Z",
    "nvd_published_at": "2025-08-28T17:15:36Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe table access voter in the back end doesn\u0027t check if a user is allowed to access the corresponding module.\n\n### Patches\n\nUpdate to Contao 5.3.38 or 5.6.1.\n\n### Workarounds\n\nDo not rely solely on the voter and additionally check `USER_CAN_ACCESS_MODULE`.\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).",
  "id": "GHSA-7m47-r75r-cx8v",
  "modified": "2025-08-28T18:51:52Z",
  "published": "2025-08-28T14:40:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57758"
    },
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7"
    },
    {
      "type": "WEB",
      "url": "https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/contao/contao"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Contao applies improper access control in the back end voters"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-56499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-18T19:15:49Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file.",
  "id": "GHSA-7m6g-3fpv-8gmx",
  "modified": "2025-11-19T15:31:38Z",
  "published": "2025-11-18T21:32:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cherrling/CVE-2025-56499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MetaCubeX/mihomo/tree/v1.19.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-01T07:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.",
  "id": "GHSA-7m6x-h8vx-f72m",
  "modified": "2023-12-01T09:30:43Z",
  "published": "2023-12-01T09:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3964"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2037316"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/419857"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.0"
            },
            {
              "fixed": "2.5.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-43759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-25T19:35:02Z",
    "nvd_published_at": "2023-02-07T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAn issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding (PRTB) and `-promoted` roles. This issue is not present in Rancher 2.7 releases.\n\nNote: Consult Rancher [documentation](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles) for more information about cluster and project roles and [KB 000020097](https://www.suse.com/support/kb/doc/?id=000020097) for information about `-promoted` roles.\n\nThis privilege escalation is possible for users with access to the `escalate` verb on PRTBs (`projectroletemplatebindings.management.cattle.io`), including users with `*` verbs on PRTBs (see notes below for more information). These users can escalate permissions for any `-promoted` resource (see the table below for a full enumeration) in any cluster where they have a PRTB granting such permissions in at least one project in the cluster.\n\nOn a default Rancher setup, only the following roles have such permissions:\n\n1. Project Owner\n2. Manage Project Members\n\nThese roles have permissions to affect the following resources:\n\n| Resource | API Group | Affected Rancher version |\n| - | - | - |\n| navlinks | ui.cattle.io | 2.6 |\n| nodes | \"\" | 2.6 |\n| persistentvolumes | \"\" | 2.5, 2.6 |\n| persistentvolumes | core | 2.5, 2.6 |\n| storageclasses | storage.k8s.io | 2.5, 2.6 |\n| apiservices | apiregistration.k8s.io | 2.5, 2.6 |\n| clusterrepos | catalog.cattle.io | 2.5, 2.6 |\n| clusters (`local` only) | management.cattle.io | 2.5, 2.6 |\n\nNotes:\n\n1. During the calculation of the CVSS score, `privileges required` was considered  as `high` because, by default, `standard user` and `user-base` users in Rancher do not have  `create`, `patch` and `update` permissions on `roletemplates`.\n2. If a role template with access to those objects was already created by another user in the cluster, then this issue can be exploited by users without the mentioned permissions from point 1.\n\n### Workarounds\n\nIf updating Rancher to a patched version is not possible, then the following workarounds must be observed to mitigate this issue:\n\n1. Only grant Project Owner and Manage Project Members roles to trusted users.\n5. Minimize the creation of custom roles that contain the `escalate`, `*` or write verbs (`create`, `delete`, `patch`, `update`) on `projectroletemplatebindings` resource, and only grant such custom roles to trusted users.\n6. Minimize the number of users that have permissions to `create`, `patch` and `update` `roletemplates`.\n\n### Patches\n\nPatched versions include releases 2.5.17 and 2.6.10 and later versions. This issue is not present in Rancher 2.7 releases.\n\n### Detection\n\nThe following script was developed to list role template bindings that give written access to the affected resources listed above. It is highly recommended to run the script in your environment and review the list of identified roles and role template bindings for possible signs of exploitation of this issue. The script requires `jq` installed and a `kubeconfig` with access to Rancher local cluster; it can also be executed in Rancher\u0027s kubectl shell.\n\n```shell\n#!/bin/bash\n\nhelp=\"\nUsage: bash find_promoted_resource.sh \\n \\n\n\nRequires: \\n\n- jq installed and on path \\n\n- A kubeconfig pointing at rancher\u0027s local cluster (can also run from rancher\u0027s kubectl shell) \\n \\n\n\nOutputs a list of roletemplates and roletemplate bindings which give write access to promoted resources.\n\"\n\nif [[ $1 == \"-h\" || $1 == \"--help\" ]]\nthen\n\techo -e $help\n\texit 0\nfi\n\n# first, get the current roletemplates so that we only issue a get once\nkubectl get roletemplates.management.cattle.io -o json \u003e\u003e script_templates.json\n\n# find roles which have write access to a promoted resource. Filter on roleTemplates which fulfill all requirements:\n# Have a project context\n# Have some rules\n# Have one/more of the target api groups, or a * in the api groups\n# Have one/more of the target resources, or a * in the resources\n# Have a verb that is not read access (i.e. a verb that is not get/list/watch)\nroles=$(jq --argjson apiGroups \u0027[\"\", \"ui.cattle.io\", \"core\", \"storage.k8s.io\", \"apiregistration.k8s.io\", \"catalog.cattle.io\", \"management.cattle.io\"]\u0027 --argjson resources \u0027[\"navlinks\", \"persistentvolumes\", \"nodes\", \"storageclasses\", \"apiservices\", \"clusterrepos\", \"clusters\"]\u0027 --argjson verbs \u0027[\"get\", \"list\", \"watch\"]\u0027 \u0027.items[] | select(.context==\"project\" and (.rules | length \u003e= 1)) | select( .rules[] | select( (($apiGroups - .apiGroups | length \u003c 7) or (.apiGroups | index(\"*\"))) and (($resources - .resources | length \u003c 7) or (.resources | index(\"*\"))) and (.verbs - $verbs  | length \u003e 0)) | length \u003e= 1 ) | .metadata.name\u0027 script_templates.json | jq -s )\n\n# log promoted roles which give direct write access so they can be easily fixed\necho \"The following role templates give direct write access to a promoted resource:\"\necho $roles\necho -e \"\"\n\n# find any roles which inherit first-level roles. Mostly a BFS which radiates outward from the known bad roles \nold_roles=\"[]\"\nnew_roles=\"$roles\"\nold_length=$(echo $old_roles | jq \u0027length\u0027)\nnew_length=$(echo $new_roles | jq \u0027length\u0027)\n# if our last loop found nothing new, it\u0027s safe to stop\nwhile [[ $old_length != $new_length ]];\ndo\n\t# set old values to what we currently know about\n\told_roles=$new_roles\n\told_length=$new_length\n\t# update new values with anything that inherits a \"bad\" role we know about\n\tnew_roles=$(jq --argjson roles \"$old_roles\" --argjson roleLen \"$old_length\" \u0027.items[] | .metadata.name as $NAME | select (( $roles | index($NAME)) or ((.roleTemplateNames | length \u003e 0 ) and ($roles - .roleTemplateNames | length \u003c $roleLen))) | .metadata.name \u0027 script_templates.json | jq -s)\n\tnew_length=$(echo $new_roles | jq \u0027length\u0027)\ndone\n\nroles=$new_roles\n\n# log all roles which can give write access, even if it\u0027s not first level\necho -e \"The following role templates give write access to a promoted resource directly or through inheritance:\"\necho $roles\necho -e \"\"\n\nkubectl get projectroletemplatebindings.management.cattle.io -A -o json \u003e\u003e script_bindings.json\nrole_template_bindings=$(jq --argjson roleTemplates \"$roles\" \u0027.items[] | .roleTemplateName as $TemplateName | select($roleTemplates | index($TemplateName)) | .metadata.name\u0027 script_bindings.json | jq -s)\n\n# since these bindings could be for users or groups, we need to include all fields which could help identify the subject. But they won\u0027t all be present, which makes the list look less pretty\necho -e \"The following is a list of bindings which give access to promoted resource, with the format of: bindingName, projectName, userName, userPrincipalName, groupName, groupPrincipalName: \"\necho $(jq --argjson bindings \"$role_template_bindings\" \u0027.items[] | .metadata.name as $BindingName | select ( $bindings | index($BindingName)) | .metadata.name, .projectName, .userName?, .userPrincipalName?, .groupName?, .groupPrincipalName?\u0027 script_bindings.json | jq -s)\n\nunset old_roles\nunset new_roles\nunset roles\nunset role_template_bindings\nrm script_templates.json\nrm script_bindings.json\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/)",
  "id": "GHSA-7m72-mh5r-6j3r",
  "modified": "2023-02-15T22:01:37Z",
  "published": "2023-01-25T19:35:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-7m72-mh5r-6j3r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43759"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1205293"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Privilege escalation in project role template binding (PRTB) and -promoted roles"
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-4501"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-05-31T01:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and make arbitrary configuration changes via unspecified vectors.",
  "id": "GHSA-7m82-m7x6-rvmx",
  "modified": "2022-05-17T03:54:29Z",
  "published": "2022-05-17T03:54:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4501"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-147-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-64066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-25T18:15:54Z",
    "severity": "HIGH"
  },
  "details": "Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application\u0027s local database. This bypasses the intended security architecture, which relies on an external Identity Provider for initial user registration and assumes that internal user creation is an administrative-only function. This vector can also be chained with other vulnerabilities for privilege escalation and complete compromise of application. This specific request can be used to also enumerate already registered user accounts, aiding in social engineering or further targeted attacks.",
  "id": "GHSA-7m84-qcmg-4ch2",
  "modified": "2025-11-25T21:32:06Z",
  "published": "2025-11-25T18:32:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n3k7ar91/Vulnerabilites/blob/main/Primakon/CVE-2025-64066.md"
    },
    {
      "type": "WEB",
      "url": "https://www.primakon.com/rjesenja/primakon-pcm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-5863"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-22T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.",
  "id": "GHSA-7m8v-v3f5-7pgw",
  "modified": "2024-04-04T00:43:00Z",
  "published": "2022-05-24T16:46:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5863"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html"
    },
    {
      "type": "WEB",
      "url": "http://open-xchange.com"
    },
    {
      "type": "WEB",
      "url": "http://ox.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}