CWE-269

{
  "affected": [],
  "aliases": [
    "CVE-2021-28697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-27T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.",
  "id": "GHSA-2h72-2hx7-mmcq",
  "modified": "2022-07-13T00:01:15Z",
  "published": "2022-05-24T19:12:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28697"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202208-23"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2021/dsa-4977"
    },
    {
      "type": "WEB",
      "url": "https://xenbits.xenproject.org/xsa/advisory-379.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1994"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-19T07:17:44Z",
    "severity": "CRITICAL"
  },
  "details": "The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user\u0027s identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
  "id": "GHSA-2h7x-xp9w-mxwc",
  "modified": "2026-02-19T18:31:50Z",
  "published": "2026-02-19T18:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1994"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/s2member/tags/260127/src/includes/classes/registrations.inc.php#L74"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3461625/s2member#file5"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31cf92-26b7-484d-8c93-ce241d655d07?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-1199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-09T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An elevation of privilege vulnerability exists when the Windows Feedback Hub improperly handles objects in memory, aka \u0027Windows Feedback Hub Elevation of Privilege Vulnerability\u0027.",
  "id": "GHSA-2h94-9rvm-hrqh",
  "modified": "2022-05-24T17:19:49Z",
  "published": "2022-05-24T17:19:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1199"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1199"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-648"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-14T20:15:13Z",
    "severity": "HIGH"
  },
  "details": "Improper Privilege Management vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users.This issue affects .",
  "id": "GHSA-2hg9-5m5v-wmhr",
  "modified": "2026-05-21T09:32:06Z",
  "published": "2023-09-14T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4972"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0526"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-23-0526"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:36:33Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nIn authenticated non-owner DM sessions, a narrow tool-invocation path could reach broader-than-intended owner-only gateway actions.\n\n## Impact\n\nThis requires an authenticated non-owner sender in a DM session and a specific tool invocation path. No unauthenticated access is involved, and this does not provide direct code execution by itself.\n\n## Root Cause\n\n- Some gateway call paths were still using broader default scopes instead of method-level least-privilege scopes.\n- Owner-only enforcement depended on tool-name checks and was not consistently metadata-driven across all call paths.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.17` (latest published npm version as of February 19, 2026)\n- Patched: `2026.2.19`\n\n## Remediation\n\n- Refactored gateway method scope mapping to a data-driven table and added guard tests to ensure all exposed core gateway methods stay classified.\n- Centralized owner-only enforcement in tool policy wrappers and tool metadata.\n- Marked owner-only tools explicitly (`cron`, `gateway`, `whatsapp_login`) and removed duplicated per-tool owner checks.\n- Refactored gateway call path internals into smaller helpers while preserving behavior and coverage.\n\n## Fix Commit(s)\n\n- `a40c10d3e24568b1e2947c104484be74bf66b8d2`\n- `2777d8ad91ef1e8a7c6f5b4b18f8507be7d02914`\n- `3d7ad1cfca4daaa84cd553e843e0e08fa6201349`\n\nOpenClaw thanks @Adam55A-code for reporting.",
  "id": "GHSA-2hm8-rqrm-xfjq",
  "modified": "2026-03-03T21:36:33Z",
  "published": "2026-03-03T21:36:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2hm8-rqrm-xfjq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/2777d8ad91ef1e8a7c6f5b4b18f8507be7d02914"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/3d7ad1cfca4daaa84cd553e843e0e08fa6201349"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/a40c10d3e24568b1e2947c104484be74bf66b8d2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw\u0027s owner-only gateway tool access checks were incomplete in specific authenticated DM flows"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7480"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266",
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-08T16:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An\u00a0Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitrary files on the system.\u00a0Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support.",
  "id": "GHSA-2hrx-xx6v-c3v2",
  "modified": "2025-10-01T03:30:26Z",
  "published": "2024-08-08T18:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7480"
    },
    {
      "type": "WEB",
      "url": "https://download.avaya.com/css/public/documents/101091159"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-23497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-27T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3, macOS Big Sur 11.7.3. An app may be able to gain root privileges.",
  "id": "GHSA-2hv7-f89v-j5wh",
  "modified": "2023-03-09T00:30:18Z",
  "published": "2023-02-27T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23497"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213603"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213604"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213605"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-12794"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-11T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization\u0027s users). This, however, could be abused in a situation where the host organization of an instance creates organization admins. An organization admin could set a password manually for the site admin or simply use the API key of the site admin to impersonate them. The potential for abuse only occurs when the host organization creates lower-privilege organization admins instead of the usual site admins. Also, only organization admins of the same organization as the site admin could abuse this.",
  "id": "GHSA-2hx6-6ffm-vq7g",
  "modified": "2026-06-22T21:30:40Z",
  "published": "2022-05-24T16:47:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12794"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/36b43f1306873cff87b7aa30cdc1a30b38c9c16a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-11465"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-01T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user\u0027s privilege, allowing an attacker to control/install helpdesk applications and leak current applications\u0027 configurations, including applications used as user sources (used for authentication). This enables an attacker to forge valid authentication models that resembles any user on the system.",
  "id": "GHSA-2j38-pmwm-2h3f",
  "modified": "2022-05-24T17:13:05Z",
  "published": "2022-05-24T17:13:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11465"
    },
    {
      "type": "WEB",
      "url": "https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro"
    },
    {
      "type": "WEB",
      "url": "https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09"
    },
    {
      "type": "WEB",
      "url": "https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "theshit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21882"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250",
      "CWE-269",
      "CWE-273"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T17:44:53Z",
    "nvd_published_at": "2026-03-02T20:16:26Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n**Vulnerability Type:** Local Privilege Escalation (LPE) / Improper Privilege Management / Arbitrary Command Execution.\n\nThe application automatically re-executes the previously failed command but does not properly drop elevated privileges during this process.\n\nWhen the tool is executed with `sudo` or otherwise runs with an effective UID of root, it records the last executed command and attempts to rerun it. However, the application fails to restore the original unprivileged user context before re-executing the command. As a result, the retried command is executed with root privileges, even if the original command was issued by an unprivileged user.\n\nThis allows a local attacker to intentionally trigger a failed command under elevated execution and gain arbitrary command execution as root via the retry mechanism.\n\n**Who is impacted:**\nAny system where this tool is executed with elevated privileges is affected. The risk is especially high in environments where the tool is permitted to run via `sudo`, including configurations with `NOPASSWD`, as an unprivileged user can escalate privileges to root without additional interaction.\n\n### Proof of Concept\n\nTo verify the vulnerability without a shell, attempt to create a file in a root-protected directory.\n\n**1. Verify the file does not exist**\n```bash\nsudo ls /root/proof_of_lpe\n# Output: No such file or directory\n```\n\n**2. Run the vulnerable command**\n```bash\nsudo bash -c \"SH_PREV_CMD=\u0027touch /root/proof_of_lpe\u0027 target/release/theshit fix\"\n```\n\n**3. Check if the file was created by root**\n```bash\nsudo ls -l /root/proof_of_lpe\n```\n\n**Expected Result:**\nThe command succeeds silently, and the file `/root/proof_of_lpe` is created, confirming arbitrary command execution with root privileges.\n\n### Patches\n\nThe issue has been fixed in version **0.1.2**.\n\nThe patch ensures that privilege levels are correctly handled during command re-execution. Before retrying any previously executed command, the application now explicitly resets the effective UID and GID to the original invoking user.\n\n### Workarounds\n\nIf upgrading is not possible, users should avoid executing the application with `sudo` or as the root user.\n\nAs a temporary mitigation, administrators should restrict the use of the tool in privileged contexts and ensure it is not included in `sudoers` configurations, particularly with `NOPASSWD`. Running the tool strictly as an unprivileged user prevents exploitation of the retry mechanism.\n\n### References\n\n* [Commit fixing the issue](https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a)\n* CWE-269: Improper Privilege Management\n* CWE-273: Improper Check for Dropped Privileges\n* CWE-250: Execution with Unnecessary Privileges",
  "id": "GHSA-2j3p-gqw5-g59j",
  "modified": "2026-03-02T21:59:23Z",
  "published": "2026-03-02T17:44:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21882"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AsfhtgkDavid/theshit"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "theshit\u0027s Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution"
}