CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
6431 vulnerabilities reference this CWE, most recent first.
GHSA-J57H-2GC3-WW5W
Vulnerability from github – Published: 2024-07-26 18:30 – Updated: 2024-08-01 15:32An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR through 23.x for macOS. Local Privilege Escalation can occur during installations or updates by admins.
{
"affected": [],
"aliases": [
"CVE-2024-27357"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-26T17:15:11Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR through 23.x for macOS. Local Privilege Escalation can occur during installations or updates by admins.",
"id": "GHSA-j57h-2gc3-ww5w",
"modified": "2024-08-01T15:32:12Z",
"published": "2024-07-26T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27357"
},
{
"type": "WEB",
"url": "https://www.withsecure.com/en/support/security-advisories/cve-2024-27357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J57W-3C39-GPP5
Vulnerability from github – Published: 2022-02-17 00:00 – Updated: 2022-02-25 15:23An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0611"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-25T15:23:16Z",
"nvd_published_at": "2022-02-16T00:15:00Z",
"severity": "HIGH"
},
"details": "An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.",
"id": "GHSA-j57w-3c39-gpp5",
"modified": "2022-02-25T15:23:16Z",
"published": "2022-02-17T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0611"
},
{
"type": "WEB",
"url": "https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439"
},
{
"type": "PACKAGE",
"url": "https://github.com/snipe/snipe-it"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/7b7447fc-f1b0-446c-b016-ee3f6511010b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Privilege Management in Snipe-IT"
}
GHSA-J5C2-HM46-WP5C
Vulnerability from github – Published: 2021-07-22 19:43 – Updated: 2021-09-03 20:23Impact
An error in the implementation of the limits service in 4.0.0 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability.
Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.9.4. Immediate action should be taken to secure your site - see patches & workarounds below.
It is highly recommended to regenerate all API keys after patching or applying the workaround below.
Patches
Fixed in 4.10.0, all 4.x sites should upgrade as soon as possible.
Workarounds
- Disable all non-Administrator accounts to prevent API access.
For more information
If you have any questions or comments about this advisory: * email us at security@ghost.org
Credits: Aden Yap Chuen Zhen, BAE Systems Applied Intelligence (Malaysia)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ghost"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39192"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-20T17:44:30Z",
"nvd_published_at": "2021-09-03T15:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn error in the implementation of the limits service in 4.0.0 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability.\n\nGhost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.9.4. Immediate action should be taken to secure your site - see patches \u0026 workarounds below.\n\nIt is highly recommended to regenerate all API keys after patching or applying the workaround below.\n\n### Patches\nFixed in 4.10.0, all 4.x sites should upgrade as soon as possible.\n\n### Workarounds\n- Disable all non-Administrator accounts to prevent API access.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* email us at security@ghost.org\n\n---\nCredits: Aden Yap Chuen Zhen, BAE Systems Applied Intelligence (Malaysia)",
"id": "GHSA-j5c2-hm46-wp5c",
"modified": "2021-09-03T20:23:05Z",
"published": "2021-07-22T19:43:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39192"
},
{
"type": "PACKAGE",
"url": "https://github.com/TryGhost/Ghost"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/Ghost/releases/tag/v4.10.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Privilege escalation: all users can access Admin-level API keys"
}
GHSA-J5G3-42WP-GQM3
Vulnerability from github – Published: 2026-08-28 22:37 – Updated: 2026-08-28 22:37Impact
The update() method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the superuser key (when the editor is not a superuser) and the admin key (when the editor is neither admin nor superuser). All other permissions — including the admin flag itself when the editing user is an admin — are discarded and $user->permissions is overwritten with the sparse result.
The canEditAuthFields gate permits admins to update other non-superuser accounts (including other admins). When an admin sends a PUT /users/{id} request for another admin without including the permission field, the target's admin flag and all granular permissions are permanently destroyed. The target loses administrative access entirely with no error, warning, or out-of-band notification.
A secondary, lower-impact path exists for non-admin users holding the users.edit permission: they may target regular (non-admin, non-superuser) accounts and wipe all granular permissions in the same way.
Patches
Patched in https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55843"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T22:37:24Z",
"nvd_published_at": "2026-07-10T19:17:26Z",
"severity": "HIGH"
},
"details": "## Impact\n\nThe `update()` method in `UsersController` passes the `permission` request field unconditionally to `NormalizePermissionsPayloadAction`, which returns an empty array when the field is absent. The result is passed to `PreserveUnauthorizedPrivilegedPermissionsAction`, which selectively restores only the `superuser` key (when the editor is not a superuser) and the `admin` key (when the editor is neither admin nor superuser). All other permissions \u2014 including the `admin` flag itself when the editing user is an admin \u2014 are discarded and `$user-\u003epermissions` is overwritten with the sparse result.\n\nThe `canEditAuthFields` gate permits admins to update other non-superuser accounts (including other admins). When an admin sends a `PUT /users/{id}` request for another admin without including the `permission` field, the target\u0027s `admin` flag and all granular permissions are permanently destroyed. The target loses administrative access entirely with no error, warning, or out-of-band notification.\n\nA secondary, lower-impact path exists for non-admin users holding the `users.edit` permission: they may target regular (non-admin, non-superuser) accounts and wipe all granular permissions in the same way.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad",
"id": "GHSA-j5g3-42wp-gqm3",
"modified": "2026-08-28T22:37:24Z",
"published": "2026-08-28T22:37:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-j5g3-42wp-gqm3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55843"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/1cff2d67aabd00ee51d864c1d7fb717494c1d6ad"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Snipe-IT has an Improper Privilege Management issue"
}
GHSA-J5G9-J7R4-6QVX
Vulnerability from github – Published: 2024-01-03 21:50 – Updated: 2024-01-03 21:50Impact
This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.
Patches
This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
References
https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.5.10"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.5.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.9.5"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.9.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-21622"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T21:50:26Z",
"nvd_published_at": "2024-01-03T17:15:12Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThis is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.\n\n### Patches\n\nThis has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.\n\n### References\n\nhttps://github.com/craftcms/cms/pull/13932\nhttps://github.com/craftcms/cms/pull/13931\nhttps://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16\nhttps://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16",
"id": "GHSA-j5g9-j7r4-6qvx",
"modified": "2024-01-03T21:50:26Z",
"published": "2024-01-03T21:50:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-j5g9-j7r4-6qvx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21622"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/pull/13931"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/pull/13932"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Craft CMS Privilege Escalation"
}
GHSA-J5P2-95X6-9MR4
Vulnerability from github – Published: 2024-12-31 00:32 – Updated: 2024-12-31 00:32An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem.
This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
{
"affected": [],
"aliases": [
"CVE-2024-13058"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-30T22:15:05Z",
"severity": "MODERATE"
},
"details": "An issue exists in SoftIron HyperCloud\n where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem.\n\nThis issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.",
"id": "GHSA-j5p2-95x6-9mr4",
"modified": "2024-12-31T00:32:47Z",
"published": "2024-12-31T00:32:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13058"
},
{
"type": "WEB",
"url": "https://advisories.softiron.cloud"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-J5R5-QRVJ-CPPQ
Vulnerability from github – Published: 2023-08-09 03:30 – Updated: 2024-04-04 06:43The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7.1 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
{
"affected": [],
"aliases": [
"CVE-2023-4239"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-09T03:15:45Z",
"severity": "MODERATE"
},
"details": "The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7.1 due to insufficient restriction on the \u0027rem_save_profile_front\u0027 function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the \u0027wp_capabilities\u0027 parameter during a profile update.",
"id": "GHSA-j5r5-qrvj-cppq",
"modified": "2024-04-04T06:43:17Z",
"published": "2023-08-09T03:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4239"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/6.7.1/classes/shortcodes.class.php#L1439"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d83d1fd0-6e21-406e-a7c0-89d26eabbb32?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J5RW-XW36-2HMR
Vulnerability from github – Published: 2026-09-11 00:31 – Updated: 2026-09-11 00:31IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.
{
"affected": [],
"aliases": [
"CVE-2026-75777"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T22:16:59Z",
"severity": "HIGH"
},
"details": "IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.",
"id": "GHSA-j5rw-xw36-2hmr",
"modified": "2026-09-11T00:31:14Z",
"published": "2026-09-11T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75777"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7286738"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J5VX-99C2-MCFV
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2026-07-05 00:31K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K7Sentry.sys.
{
"affected": [],
"aliases": [
"CVE-2018-8044"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-11T16:15:00Z",
"severity": "HIGH"
},
"details": "K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K7Sentry.sys.",
"id": "GHSA-j5vx-99c2-mcfv",
"modified": "2026-07-05T00:31:16Z",
"published": "2022-05-24T17:38:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8044"
},
{
"type": "WEB",
"url": "https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021"
},
{
"type": "WEB",
"url": "http://k7antivirus.com"
},
{
"type": "WEB",
"url": "http://k7computing.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J5WG-H8JH-FX4V
Vulnerability from github – Published: 2023-04-18 21:30 – Updated: 2024-04-04 03:32Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
{
"affected": [],
"aliases": [
"CVE-2023-21896"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-18T20:15:11Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"id": "GHSA-j5wg-h8jh-fx4v",
"modified": "2024-04-04T03:32:19Z",
"published": "2023-04-18T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21896"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.