Common Weakness Enumeration
CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
2179 vulnerabilities reference this CWE, most recent first.
GHSA-7GMX-VW6R-9XRM
Vulnerability from github – Published: 2026-03-02 09:30 – Updated: 2026-03-02 09:30
VLAI
Details
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-15597"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T07:16:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the component API Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.0 mitigates this issue. The name of the patch is d640ac31d1ce64ce90e06cf7081163915c9fc28c. Upgrading the affected component is recommended. Multiple endpoints are affected. The vendor was contacted early about this disclosure.",
"id": "GHSA-7gmx-vw6r-9xrm",
"modified": "2026-03-02T09:30:30Z",
"published": "2026-03-02T09:30:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot/security/advisories/GHSA-h4xm-3q3p-5g6r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15597"
},
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot/commit/d640ac31d1ce64ce90e06cf7081163915c9fc28c"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707295"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707294"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707293"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707288"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707286"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707285"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707284"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.707283"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.706144"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.348291"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.348291"
},
{
"type": "WEB",
"url": "https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-User-Management-Broken-Access-Control.md"
},
{
"type": "WEB",
"url": "https://github.com/yaowenxiao721/Poc/blob/main/SQLBot/SQLBot-AIModel-Management-Missing-Authorization.md"
},
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot/releases/tag/v1.5.0"
},
{
"type": "WEB",
"url": "https://github.com/dataease/SQLBot"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GP3-6WQ2-PF7V
Vulnerability from github – Published: 2025-09-13 21:31 – Updated: 2025-09-13 21:31
VLAI
Details
A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-10374"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-13T19:15:31Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.",
"id": "GHSA-7gp3-6wq2-pf7v",
"modified": "2025-09-13T21:31:36Z",
"published": "2025-09-13T21:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10374"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323788"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323788"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.639092"
},
{
"type": "WEB",
"url": "https://www.yuque.com/hongzh0/tx13c7/lgb05p6ar7ybugcz"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GPQ-5JCR-FH27
Vulnerability from github – Published: 2025-09-08 00:30 – Updated: 2025-09-08 00:30
VLAI
Details
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-10073"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-08T00:15:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-7gpq-5jcr-fh27",
"modified": "2025-09-08T00:30:19Z",
"published": "2025-09-08T00:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10073"
},
{
"type": "WEB",
"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Api.turma.md"
},
{
"type": "WEB",
"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10073.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.323021"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.323021"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.644136"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GXR-VXJ9-9X53
Vulnerability from github – Published: 2024-10-30 09:30 – Updated: 2026-04-01 18:32
VLAI
Details
Incorrect Privilege Assignment vulnerability in Matt Whiteman Bulk Change Role allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through 1.1.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-50504"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-30T08:15:03Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in Matt Whiteman Bulk Change Role allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through 1.1.",
"id": "GHSA-7gxr-vxj9-9x53",
"modified": "2026-04-01T18:32:14Z",
"published": "2024-10-30T09:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50504"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/bulk-role-change/vulnerability/wordpress-bulk-change-role-plugin-1-1-privilege-escalation-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/bulk-role-change/wordpress-bulk-change-role-plugin-1-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HCG-H92Q-PJ2J
Vulnerability from github – Published: 2025-08-28 15:30 – Updated: 2026-04-01 18:36
VLAI
Details
Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin allows Privilege Escalation. This issue affects Miraculous Core Plugin: from n/a through 2.0.7.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-49388"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-28T13:15:59Z",
"severity": "CRITICAL"
},
"details": "Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin allows Privilege Escalation. This issue affects Miraculous Core Plugin: from n/a through 2.0.7.",
"id": "GHSA-7hcg-h92q-pj2j",
"modified": "2026-04-01T18:36:00Z",
"published": "2025-08-28T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49388"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-7-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HJG-42GH-8J3V
Vulnerability from github – Published: 2026-01-14 09:31 – Updated: 2026-04-23 18:32
VLAI
Details
Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.
Severity
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-23550"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T09:16:02Z",
"severity": "CRITICAL"
},
"details": "Incorrect Privilege Assignment vulnerability in Modular DS allows Privilege Escalation.This issue affects Modular DS: from n/a through 2.5.1.",
"id": "GHSA-7hjg-42gh-8j3v",
"modified": "2026-04-23T18:32:23Z",
"published": "2026-01-14T09:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550"
},
{
"type": "WEB",
"url": "https://help.modulards.com/en/article/modular-ds-security-release-modular-connector-252-dm3mv0"
},
{
"type": "WEB",
"url": "https://patchstack.com/articles/critical-privilege-escalation-vulnerability-in-modular-ds-plugin-affecting-40k-sites-exploited-in-the-wild"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HJQ-WMFX-V2H8
Vulnerability from github – Published: 2025-09-19 21:31 – Updated: 2025-09-19 21:31
VLAI
Details
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-26517"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-19T19:15:38Z",
"severity": "MODERATE"
},
"details": "StorageGRID (formerly \nStorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are \nsusceptible to a privilege escalation vulnerability. Successful exploit \ncould allow an unauthorized authenticated attacker to discover Grid node\n names and IP addresses or modify Storage Grades.",
"id": "GHSA-7hjq-wmfx-v2h8",
"modified": "2025-09-19T21:31:17Z",
"published": "2025-09-19T21:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26517"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/NTAP-20250910-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7HMV-R6W5-PR73
Vulnerability from github – Published: 2026-08-06 06:30 – Updated: 2026-08-06 06:30
VLAI
Details
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-18998"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T06:16:32Z",
"severity": "LOW"
},
"details": "A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-7hmv-r6w5-pr73",
"modified": "2026-08-06T06:30:33Z",
"published": "2026-08-06T06:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18998"
},
{
"type": "WEB",
"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/74"
},
{
"type": "WEB",
"url": "https://github.com/cosmicstack-labs/mercury-agent"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-18998"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862628"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/862629"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/386381"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/386381/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7JG4-8PC3-8QW9
Vulnerability from github – Published: 2025-12-18 09:30 – Updated: 2026-01-20 15:32
VLAI
Details
Incorrect Privilege Assignment vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-woocommerce allows Privilege Escalation.This issue affects Custom Fields Account Registration For Woocommerce: from n/a through <= 1.2.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2025-49379"
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-18T08:15:51Z",
"severity": "HIGH"
},
"details": "Incorrect Privilege Assignment vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-woocommerce allows Privilege Escalation.This issue affects Custom Fields Account Registration For Woocommerce: from n/a through \u003c= 1.2.",
"id": "GHSA-7jg4-8pc3-8qw9",
"modified": "2026-01-20T15:32:18Z",
"published": "2025-12-18T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49379"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/custom-fields-account-registration-for-woocommerce/vulnerability/wordpress-custom-fields-account-registration-for-woocommerce-plugin-1-2-privilege-escalation-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/custom-fields-account-registration-for-woocommerce/vulnerability/wordpress-custom-fields-account-registration-for-woocommerce-plugin-1-2-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JP6-R74R-995Q
Vulnerability from github – Published: 2026-04-17 22:15 – Updated: 2026-05-08 01:32
VLAI
Summary
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
Details
Summary
Matrix profile config persistence was reachable from operator.write message tools.
Affected Packages / Versions
- Package:
openclaw - Ecosystem: npm
- Affected versions:
< 2026.4.10 - Patched versions:
>= 2026.4.10
Impact
Gateway operator.write message-tool paths could reach Matrix profile persistence that should have required admin-level authority.
Technical Details
The fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config.
Fix
The issue was fixed in #62662. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.
Fix Commit(s)
fe0f686c9228fffcec6de4011da45e69a6e23e54- PR: #62662
Release Process Note
Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.
Credits
Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42433"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-17T22:15:27Z",
"nvd_published_at": "2026-05-05T12:16:17Z",
"severity": "HIGH"
},
"details": "## Summary\n\nMatrix profile config persistence was reachable from operator.write message tools.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.10`\n- Patched versions: `\u003e= 2026.4.10`\n\n## Impact\n\nGateway `operator.write` message-tool paths could reach Matrix profile persistence that should have required admin-level authority.\n\n## Technical Details\n\nThe fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config.\n\n## Fix\n\nThe issue was fixed in #62662. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `fe0f686c9228fffcec6de4011da45e69a6e23e54`\n- PR: #62662\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.",
"id": "GHSA-7jp6-r74r-995q",
"modified": "2026-05-08T01:32:22Z",
"published": "2026-04-17T22:15:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-7jp6-r74r-995q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42433"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/pull/62662"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/fe0f686c9228fffcec6de4011da45e69a6e23e54"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-unauthorized-matrix-profile-config-persistence-access-via-operator-write-message-tools"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Matrix profile config persistence was reachable from operator.write message tools"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.