Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

6372 vulnerabilities reference this CWE, most recent first.

GHSA-CXP4-JFMX-C3WX

Vulnerability from github – Published: 2026-08-18 21:33 – Updated: 2026-08-18 21:33
VLAI
Details

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-70842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T21:17:39Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).   The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management.  While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).",
  "id": "GHSA-cxp4-jfmx-c3wx",
  "modified": "2026-08-18T21:33:01Z",
  "published": "2026-08-18T21:33:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70842"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CXQ4-8FF4-35JM

Vulnerability from github – Published: 2023-12-30 21:30 – Updated: 2024-10-10 18:31
VLAI
Details

Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.

Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6998"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-305"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-30T19:15:08Z",
    "severity": "HIGH"
  },
  "details": "Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.\n\n",
  "id": "GHSA-cxq4-8ff4-35jm",
  "modified": "2024-10-10T18:31:07Z",
  "published": "2023-12-30T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6998"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2023/12/CVE-2023-6998"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/posts/2023/12/CVE-2023-6998"
    },
    {
      "type": "WEB",
      "url": "https://ewelink.cc/app"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CXQP-79P3-87WM

Vulnerability from github – Published: 2021-12-24 00:00 – Updated: 2022-01-06 00:01
VLAI
Details

A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan. An attacker with physical access to a device may be able to elevate privileges.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-4478"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-23T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan. An attacker with physical access to a device may be able to elevate privileges.",
  "id": "GHSA-cxqp-79p3-87wm",
  "modified": "2022-01-06T00:01:18Z",
  "published": "2021-12-24T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4478"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT208849"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-CXRH-MFQ9-V727

Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2026-08-19 18:31
VLAI
Details

Windows Event Tracing Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26872, CVE-2021-26901.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-26898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-11T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Windows Event Tracing Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26872, CVE-2021-26901.",
  "id": "GHSA-cxrh-mfq9-v727",
  "modified": "2026-08-19T18:31:32Z",
  "published": "2022-05-24T17:44:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26898"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26898"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26898"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CXVF-GVFQ-36W2

Vulnerability from github – Published: 2026-09-03 19:23 – Updated: 2026-09-03 19:23
VLAI
Summary
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Details

Summary

Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom project role through POST /api/project/{id}/roles, a route gated only by the CanManageProjectResources permission that manager already holds.

The role-creation validator does not reserve the built-in slug names (owner, manager, task_runner, guest) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug manager carrying the full bitmask 15, including the two owner-only bits CanUpdateProject and CanManageProjectUsers that manager does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager's effective permissions become owner-equivalent.

Result: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner.

Affected

semaphoreui/semaphore v2.18.12 (current latest as of 2026-06-09) and develop HEAD. Confirmed live-exploitable on v2.18.12 (commit 8a4dcf0); the affected files are unchanged on develop with no fix commit since the tag. Earlier releases that ship PRO custom project roles are likely affected but were not tested.

Requires the PRO build (custom project roles). The official semaphoreui/semaphore Docker image ships this feature active by default, with no subscription or configuration flag.

Pure community builds without custom project roles are not affected: the role-creation endpoint returns 404 there.

Root cause

ProjectMiddleware reads the member's built-in role permissions, then calls GetProjectOrGlobalRoleBySlug and, when a role row shares the member's role slug, replaces the effective permission bitmask with the database value (api/projects/project.go:49-53). GetProjectOrGlobalRoleBySlug(projectID, slug) accepts a project id but runs select * from role where slug=?, ignoring project scope (db/sql/role.go:59-62). ValidateRole checks only that the role name is non-empty, and enforces neither a reserved-slug list nor a permission ceiling (db/Role.go:10-15). The role-creation route POST /api/project/{id}/roles is gated by CanManageProjectResources (api/router.go:294,354), a bit the built-in manager role holds, while the actions it unlocks are gated by the owner-only CanUpdateProject and CanManageProjectUsers (api/router.go:364,380). A manager creates a row with slug manager and permissions 15, and the next request resolves the manager's effective permissions to the owner bitmask.

Reproduction

semaphoreui/semaphore v2.18.12 Docker (official image, PRO build), default config, default roles.

  1. An admin or owner adds the attacker to a project with the built-in manager role; the attacker confirms the baseline, where owner-only endpoints are denied.
GET  /api/project/42/role     Cookie: semaphore=<manager-session>
  -> {"role":"manager","permissions":5}
PUT  /api/project/42          Cookie: semaphore=<manager-session>
  -> HTTP/1.1 403 Forbidden
  1. The manager creates a custom role whose slug collides with the built-in manager and carries every permission bit.
POST /api/project/42/roles    Cookie: semaphore=<manager-session>
Content-Type: application/json
{"slug":"manager","name":"pwn","permissions":15}
  -> HTTP/1.1 201 Created
     {"slug":"manager","name":"pwn","permissions":15,"project_id":42}
  1. On the next request the manager holds the owner bitmask and performs owner-only actions.
GET  /api/project/42/role  -> {"role":"manager","permissions":15}
PUT  /api/project/42       {"id":42,"name":"owned","alert":false}      -> 204 No Content
POST /api/project/42/users {"user_id":99,"role":"task_runner"}         -> 204 No Content

Live-verified: a manager with permissions 5 obtains permissions 15 with one POST, then changes project settings and adds project members, both of which return 403 before the role is created.

Impact

  • Full administrative control of the project from a non-owner role: change project settings, delete the project.
  • Add, remove, and re-role project members, including granting roles the attacker should not control.
  • Removal or demotion of the legitimate project owner.
  • Reached by the project manager role in default config with one request; not reachable by task_runner, guest, or unauthenticated callers.

Credit

Jan Kahmen, turingpoint (jan@turingpoint.de)

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/semaphoreui/semaphore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260705182501-bb2a4e1f08c8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:23:42Z",
    "nvd_published_at": "2026-08-12T16:17:22Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nSemaphore resolves a project member\u0027s effective permissions in `ProjectMiddleware` by looking up a role row whose slug matches the member\u0027s assigned role, and overwrites the built-in permission bitmask with that row\u0027s value. A member holding the built-in `manager` role creates a custom project role through `POST /api/project/{id}/roles`, a route gated only by the `CanManageProjectResources` permission that `manager` already holds.\n\nThe role-creation validator does not reserve the built-in slug names (`owner`, `manager`, `task_runner`, `guest`) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug `manager` carrying the full bitmask `15`, including the two owner-only bits `CanUpdateProject` and `CanManageProjectUsers` that `manager` does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager\u0027s effective permissions become owner-equivalent.\n\nResult: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner.\n\n## Affected\n\nsemaphoreui/semaphore v2.18.12 (current latest as of 2026-06-09) and `develop` HEAD. Confirmed live-exploitable on v2.18.12 (commit 8a4dcf0); the affected files are unchanged on `develop` with no fix commit since the tag. Earlier releases that ship PRO custom project roles are likely affected but were not tested.\n\nRequires the PRO build (custom project roles). The official `semaphoreui/semaphore` Docker image ships this feature active by default, with no subscription or configuration flag.\n\nPure community builds without custom project roles are not affected: the role-creation endpoint returns 404 there.\n\n## Root cause\n\n`ProjectMiddleware` reads the member\u0027s built-in role permissions, then calls `GetProjectOrGlobalRoleBySlug` and, when a role row shares the member\u0027s role slug, replaces the effective permission bitmask with the database value (`api/projects/project.go:49-53`). `GetProjectOrGlobalRoleBySlug(projectID, slug)` accepts a project id but runs `select * from role where slug=?`, ignoring project scope (`db/sql/role.go:59-62`). `ValidateRole` checks only that the role name is non-empty, and enforces neither a reserved-slug list nor a permission ceiling (`db/Role.go:10-15`). The role-creation route `POST /api/project/{id}/roles` is gated by `CanManageProjectResources` (`api/router.go:294,354`), a bit the built-in `manager` role holds, while the actions it unlocks are gated by the owner-only `CanUpdateProject` and `CanManageProjectUsers` (`api/router.go:364,380`). A manager creates a row with slug `manager` and permissions `15`, and the next request resolves the manager\u0027s effective permissions to the owner bitmask.\n\n## Reproduction\n\nsemaphoreui/semaphore v2.18.12 Docker (official image, PRO build), default config, default roles.\n\n1. An admin or owner adds the attacker to a project with the built-in `manager` role; the attacker confirms the baseline, where owner-only endpoints are denied.\n\n```\nGET  /api/project/42/role     Cookie: semaphore=\u003cmanager-session\u003e\n  -\u003e {\"role\":\"manager\",\"permissions\":5}\nPUT  /api/project/42          Cookie: semaphore=\u003cmanager-session\u003e\n  -\u003e HTTP/1.1 403 Forbidden\n```\n\n2. The manager creates a custom role whose slug collides with the built-in `manager` and carries every permission bit.\n\n```\nPOST /api/project/42/roles    Cookie: semaphore=\u003cmanager-session\u003e\nContent-Type: application/json\n{\"slug\":\"manager\",\"name\":\"pwn\",\"permissions\":15}\n  -\u003e HTTP/1.1 201 Created\n     {\"slug\":\"manager\",\"name\":\"pwn\",\"permissions\":15,\"project_id\":42}\n```\n\n3. On the next request the manager holds the owner bitmask and performs owner-only actions.\n\n```\nGET  /api/project/42/role  -\u003e {\"role\":\"manager\",\"permissions\":15}\nPUT  /api/project/42       {\"id\":42,\"name\":\"owned\",\"alert\":false}      -\u003e 204 No Content\nPOST /api/project/42/users {\"user_id\":99,\"role\":\"task_runner\"}         -\u003e 204 No Content\n```\n\nLive-verified: a manager with permissions `5` obtains permissions `15` with one POST, then changes project settings and adds project members, both of which return 403 before the role is created.\n\n## Impact\n\n- Full administrative control of the project from a non-owner role: change project settings, delete the project.\n- Add, remove, and re-role project members, including granting roles the attacker should not control.\n- Removal or demotion of the legitimate project owner.\n- Reached by the project `manager` role in default config with one request; not reachable by `task_runner`, `guest`, or unauthenticated callers.\n\n## Credit\n\nJan Kahmen, [turingpoint](https://www.turingpoint.de) (jan@turingpoint.de)",
  "id": "GHSA-cxvf-gvfq-36w2",
  "modified": "2026-09-03T19:23:42Z",
  "published": "2026-09-03T19:23:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73293"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/semaphoreui/semaphore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision"
}

GHSA-F235-5F65-669J

Vulnerability from github – Published: 2022-05-13 01:45 – Updated: 2022-05-13 01:45
VLAI
Details

EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-4982"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-08T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be exploited by malicious users to compromise the affected system.",
  "id": "GHSA-f235-5f65-669j",
  "modified": "2022-05-13T01:45:59Z",
  "published": "2022-05-13T01:45:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-4982"
    },
    {
      "type": "WEB",
      "url": "https://packetstormsecurity.com/files/cve/CVE-2017-4982"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/540531/30/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98049"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F24J-7HHF-MFRW

Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-06-29 00:00
VLAI
Details

In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174046397

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-0487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-11T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174046397",
  "id": "GHSA-f24j-7hhf-mfrw",
  "modified": "2022-06-29T00:00:39Z",
  "published": "2022-05-24T19:05:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0487"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2021-05-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F24J-F97W-65H8

Vulnerability from github – Published: 2022-05-24 16:57 – Updated: 2023-10-05 18:46
VLAI
Summary
Centreon Privilege Escalation
Details

In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "centreon/centreon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.04.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-21025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-20T00:07:10Z",
    "nvd_published_at": "2019-10-08T13:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.",
  "id": "GHSA-f24j-f97w-65h8",
  "modified": "2023-10-05T18:46:11Z",
  "published": "2022-05-24T16:57:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21025"
    },
    {
      "type": "WEB",
      "url": "https://github.com/centreon/centreon-archived/issues/7082"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/centreon/centreon-archived"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2019/10/08/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Centreon Privilege Escalation "
}

GHSA-F25W-CG92-FW9V

Vulnerability from github – Published: 2026-09-15 21:32 – Updated: 2026-09-15 21:32
VLAI
Details

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-87214"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T20:19:09Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).   The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management.  While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
  "id": "GHSA-f25w-cg92-fw9v",
  "modified": "2026-09-15T21:32:53Z",
  "published": "2026-09-15T21:32:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87214"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspusep2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F25X-J567-FFXH

Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-08-11 12:30
VLAI
Details

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-72537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T12:17:38Z",
    "severity": "HIGH"
  },
  "details": "A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.",
  "id": "GHSA-f25x-j567-ffxh",
  "modified": "2026-08-11T12:30:23Z",
  "published": "2026-08-11T12:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72537"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list