Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

5643 vulnerabilities reference this CWE, most recent first.

GHSA-4X5W-CX28-862G

Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2024-04-04 07:54
VLAI
Details

Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-41312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-27T15:19:29Z",
    "severity": "MODERATE"
  },
  "details": "Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.",
  "id": "GHSA-4x5w-cx28-862g",
  "modified": "2024-04-04T07:54:14Z",
  "published": "2023-09-27T15:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41312"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2023/9"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202309-0000001638925158"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4X62-HPQM-W7CR

Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-24 17:07
VLAI
Details

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 174397.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-4163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-04T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 174397.",
  "id": "GHSA-4x62-hpqm-w7cr",
  "modified": "2022-05-24T17:07:58Z",
  "published": "2022-05-24T17:07:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4163"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/174397"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/1288786"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4X6W-78CR-J4XH

Vulnerability from github – Published: 2024-05-17 09:31 – Updated: 2024-05-17 09:31
VLAI
Details

Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.

Severity
8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-47683"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-17T09:15:12Z",
    "severity": "HIGH"
  },
  "details": "Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.",
  "id": "GHSA-4x6w-78cr-j4xh",
  "modified": "2024-05-17T09:31:01Z",
  "published": "2024-05-17T09:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47683"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/miniorange-login-openid/wordpress-social-login-social-sharing-by-miniorange-plugin-7-6-6-authenticated-privilege-escalation-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4X6X-WGR7-8M4F

Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46
VLAI
Details

This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to elevate privileges.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-29620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-02T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to elevate privileges.",
  "id": "GHSA-4x6x-wgr7-8m4f",
  "modified": "2022-05-24T17:46:13Z",
  "published": "2022-05-24T17:46:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29620"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT212011"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4XF3-WPM7-J6C9

Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2022-05-24 17:08
VLAI
Details

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0753.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-0754"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-11T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka \u0027Windows Error Reporting Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0753.",
  "id": "GHSA-4xf3-wpm7-j6c9",
  "modified": "2022-05-24T17:08:34Z",
  "published": "2022-05-24T17:08:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0754"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0754"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4XH5-JCJ2-CH8Q

Vulnerability from github – Published: 2026-01-21 22:23 – Updated: 2026-01-22 15:40
VLAI
Summary
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims
Details

A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges.

After OIDC token claims are processed through CEL expressions, there is no validation that the resulting username and groups values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account's credentials instead of the authenticated user's limited permissions.

Impact

  • Privilege Escalation: Any authenticated user can escalate to operator-level read permissions and perform suspend/resume/reconcile actions
  • Data Exposure: Unauthorized read access to Flux resources across all namespaces, bypassing RBAC restrictions
  • Information Disclosure: View sensitive GitOps pipeline configurations, source URLs, and deployment status across the entire cluster

Attack Scenario

Prerequisite: Cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., email, groups), or configure custom CEL expressions that can evaluate to empty values.

  1. Cluster admin configures OIDC authentication with a provider that does not include email or groups claims in tokens
  2. User authenticates with a valid token from that provider
  3. The default CEL expressions evaluate to empty values:
  4. Username: has(claims.email) ? claims.email : '' → ""
  5. Groups: has(claims.groups) ? claims.groups : [] → []
  6. Authentication succeeds (token signature is valid)
  7. A userClient is created with empty impersonation config
  8. All subsequent API requests bypass impersonation and execute as the flux-operator service account
  9. User gains operator-level read access across all namespaces

Patches

This vulnerability was fixed in Flux Operator v0.40.0.

Workarounds

The workaround is to make the email and groups claims required in the web config impersonation section.

Example config:

apiVersion: web.fluxcd.controlplane.io/v1
kind: Config
spec:
  baseURL: https://flux.example.com
  authentication:
    type: OAuth2
    oauth2:
      provider: OIDC
      clientID: "<redacted>"
      clientSecret: "<redacted>"
      issuerURL: "https://login.microsoftonline.com/<redacted>/v2.0"
      scopes: [openid, profile, email, offline_access]
      impersonation:
        username: claims.email
        groups: claims.groups

References

See the Pull Request fixing this vulnerability https://github.com/controlplaneio-fluxcd/flux-operator/pull/610

Credits

This vulnerability was discovered by the Flux Operator maintainers during a debugging session with end-users.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/controlplaneio-fluxcd/flux-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.36.0"
            },
            {
              "fixed": "0.40.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23990"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T22:23:33Z",
    "nvd_published_at": "2026-01-21T23:15:52Z",
    "severity": "MODERATE"
  },
  "details": "A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator\u0027s service account privileges.\n\nAfter OIDC token claims are processed through CEL expressions, there is no validation that the resulting `username` and `groups` values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account\u0027s credentials instead of the authenticated user\u0027s limited permissions.\n\n### Impact\n\n- **Privilege Escalation**: Any authenticated user can escalate to operator-level read permissions and perform suspend/resume/reconcile actions\n- **Data Exposure**: Unauthorized read access to Flux resources across all namespaces, bypassing RBAC restrictions\n- **Information Disclosure**: View sensitive GitOps pipeline configurations, source URLs, and deployment status across the entire cluster\n\n### Attack Scenario\n\n**Prerequisite**: Cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., `email`, `groups`), or configure custom CEL expressions that can evaluate to empty values.\n\n1. Cluster admin configures OIDC authentication with a provider that does not include `email` or `groups` claims in tokens\n2. User authenticates with a valid token from that provider\n3. The default CEL expressions evaluate to empty values:\n   - Username: `has(claims.email) ? claims.email : \u0027\u0027` \u2192 `\"\"`\n   - Groups: `has(claims.groups) ? claims.groups : []` \u2192 `[]`\n4. Authentication succeeds (token signature is valid)\n5. A userClient is created with empty impersonation config\n6. All subsequent API requests bypass impersonation and execute as the flux-operator service account\n7. User gains operator-level read access across all namespaces\n\n### Patches\n\nThis vulnerability was fixed in Flux Operator v0.40.0.\n\n### Workarounds\n\nThe workaround is to make the `email` and `groups` claims required in the web config `impersonation` section.\n\nExample config:\n\n```yaml\napiVersion: web.fluxcd.controlplane.io/v1\nkind: Config\nspec:\n  baseURL: https://flux.example.com\n  authentication:\n    type: OAuth2\n    oauth2:\n      provider: OIDC\n      clientID: \"\u003credacted\u003e\"\n      clientSecret: \"\u003credacted\u003e\"\n      issuerURL: \"https://login.microsoftonline.com/\u003credacted\u003e/v2.0\"\n      scopes: [openid, profile, email, offline_access]\n      impersonation:\n        username: claims.email\n        groups: claims.groups\n```\n\n### References\n\nSee the Pull Request fixing this vulnerability https://github.com/controlplaneio-fluxcd/flux-operator/pull/610 \n\n### Credits\n\nThis vulnerability was discovered by the Flux Operator maintainers during a debugging session with end-users.",
  "id": "GHSA-4xh5-jcj2-ch8q",
  "modified": "2026-01-22T15:40:22Z",
  "published": "2026-01-21T22:23:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23990"
    },
    {
      "type": "WEB",
      "url": "https://github.com/controlplaneio-fluxcd/flux-operator/pull/610"
    },
    {
      "type": "WEB",
      "url": "https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/controlplaneio-fluxcd/flux-operator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims"
}

GHSA-4XJC-QQH2-PGWJ

Vulnerability from github – Published: 2021-12-02 00:00 – Updated: 2022-04-27 00:00
VLAI
Details

The AMDPowerProfiler.sys driver of AMD ?Prof tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-26334"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-01T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The AMDPowerProfiler.sys driver of AMD ?Prof tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.",
  "id": "GHSA-4xjc-qqh2-pgwj",
  "modified": "2022-04-27T00:00:50Z",
  "published": "2021-12-02T00:00:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26334"
    },
    {
      "type": "WEB",
      "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4XPH-HCW4-77X7

Vulnerability from github – Published: 2025-02-14 18:30 – Updated: 2025-02-14 21:31
VLAI
Details

An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.

Severity
5.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-57778"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-14T16:15:34Z",
    "severity": "MODERATE"
  },
  "details": "An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.",
  "id": "GHSA-4xph-hcw4-77x7",
  "modified": "2025-02-14T21:31:04Z",
  "published": "2025-02-14T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57778"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KUK3N4N/CVE-2024-57778"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4XPH-R595-WP4R

Vulnerability from github – Published: 2021-11-21 00:00 – Updated: 2024-02-27 19:03
VLAI
Details

Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-36307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-20T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system.",
  "id": "GHSA-4xph-r595-wp4r",
  "modified": "2024-02-27T19:03:42Z",
  "published": "2021-11-21T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36307"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000193076"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4XPQ-67Q3-73XV

Vulnerability from github – Published: 2021-12-16 00:00 – Updated: 2022-07-13 00:01
VLAI
Details

In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031401

Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-1019"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-15T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031401",
  "id": "GHSA-4xpq-67q3-73xv",
  "modified": "2022-07-13T00:01:00Z",
  "published": "2021-12-16T00:00:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1019"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2021-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list