CWE-269

{
  "affected": [],
  "aliases": [
    "CVE-2020-5832"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-06T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.",
  "id": "GHSA-r9p7-fvg8-jvc8",
  "modified": "2022-05-24T17:13:25Z",
  "published": "2022-05-24T17:13:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5832"
    },
    {
      "type": "WEB",
      "url": "https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1750"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-14T10:15:09Z",
    "severity": "HIGH"
  },
  "details": "\nThe vulnerability potentially allows an attacker to misuse ESET\u2019s file operations during the module update to delete or move files without having proper permissions.",
  "id": "GHSA-r9qp-q9m8-hww3",
  "modified": "2024-04-04T06:54:43Z",
  "published": "2023-08-14T12:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3160"
    },
    {
      "type": "WEB",
      "url": "https://support.eset.com/en/ca8466"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-19305"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-03T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.",
  "id": "GHSA-r9w6-qwp4-r3rx",
  "modified": "2022-07-11T00:00:22Z",
  "published": "2022-05-24T19:10:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19305"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MRdoulestar/CodeAnalyse/issues/2"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/36.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-23T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escalate their privileges and modify settings in SANtricity System Manager.",
  "id": "GHSA-r9wc-xprp-2665",
  "modified": "2022-07-13T00:01:12Z",
  "published": "2021-12-24T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27006"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20211221-0001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-24519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-09T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Azure Site Recovery Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24469, CVE-2022-24506, CVE-2022-24515, CVE-2022-24518.",
  "id": "GHSA-rc59-5q59-7787",
  "modified": "2022-03-17T00:02:11Z",
  "published": "2022-03-10T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24519"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24519"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24519"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-12T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-22022, CVE-2022-30206, CVE-2022-30226.",
  "id": "GHSA-rc8p-h3m3-5mqp",
  "modified": "2022-07-13T00:00:39Z",
  "published": "2022-07-13T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22041"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22041"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22041"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-8218"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-19T07:15:30Z",
    "severity": "HIGH"
  },
  "details": "The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the \u0027change_role_member\u0027 parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update.",
  "id": "GHSA-rcch-6gmj-jf47",
  "modified": "2025-08-19T09:30:30Z",
  "published": "2025-08-19T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8218"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d07880b-9af1-4b1e-aa70-b95ef10a6e33?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47411"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-01T14:23:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n**Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role=\"member\"`). Any member can rewrite the workspace\u0027s `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object \u2014 depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there.\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74; `services/workspace_service.py`\u0027s `update()` method.\n**Root cause:** `Depends(require_workspace_member)` resolves to default `min_role=\"member\"`. `WorkspaceService.update(workspace_id, name, description, settings)` writes the new fields to the workspace row without any caller-permission check. The role hierarchy (`MemberService.has_role`) is never consulted.\n\n## Affected Code\n\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74.\n\n```python\n@router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\nasync def update_workspace(\n    workspace_id: str,\n    body: WorkspaceUpdate,\n    user: AuthIdentity = Depends(require_workspace_member),         # \u003c-- BUG: defaults to min_role=\"member\"\n    session: AsyncSession = Depends(get_db),\n):\n    ws_svc = WorkspaceService(session)\n    ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)  # \u003c-- writes any value\n    if ws is None:\n        raise HTTPException(status_code=404, detail=\"Workspace not found\")\n    return WorkspaceResponse.model_validate(ws)\n```\n\n**Why it\u0027s wrong:** workspace name and settings are owner-tier fields. Renaming the workspace to a profanity is a low-impact griefing vector; rewriting the JSON `settings` blob is potentially a much higher-impact configuration injection (depending on what fields downstream code reads from `settings`, the attacker may flip feature flags, redirect webhook URLs, change LLM provider keys for shared configs, disable audit logging, etc.). The `require_workspace_member(min_role)` parameter is implemented and unused. This endpoint should require owner.\n\n## Exploit Chain\n\n1. Attacker is a member of workspace `W` with role \"member\". State: attacker holds JWT.\n2. Attacker sends `PATCH /workspaces/W` with `Authorization: Bearer \u003cattacker_jwt\u003e` and body `{\"name\": \"Compromised\", \"description\": \"Owned by attacker\", \"settings\": {\"allow_public_invite\": true, \"ai_provider_url\": \"https://attacker.example/v1\"}}`. State: control flow enters `update_workspace`.\n3. `require_workspace_member(W, attacker)` passes. `WorkspaceService.update(W, ...)` writes the three fields. State: workspace `W` now has attacker-chosen name, description, and settings.\n4. The settings JSON is read by any downstream code that consults workspace settings (LLM proxying, invite flows, webhook routing). If the deployment uses settings-keyed configuration overrides, those overrides now point at attacker-controlled endpoints.\n5. Final state: with one member-level token plus one PATCH, the attacker rewrites the workspace\u0027s metadata and settings, with effects ranging from cosmetic (rename) to substantive (settings-keyed config injection).\n\n## Security Impact\n\n**Severity:** sec-moderate. CVSS 6.5: network attack, low complexity, low privileges, no user interaction, scope unchanged, no confidentiality directly (though settings rewrites may enable indirect data exfiltration via attacker-pointed integration URLs), high integrity, no availability claim.\n**Attacker capability:** rewrite any workspace\u0027s name, description, and settings JSON. The actual blast radius depends on what fields the deployment reads from `settings` \u2014 but that field is documented as a free-form JSON blob, so any future configuration the platform adds there becomes attacker-tunable.\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; attacker has any membership token in the target workspace.\n**Differential:** source-inspection-verified. With the suggested fix below, member-tier tokens fail the gate and the metadata rewrite is rejected with 403.\n\n## Suggested Fix\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n+++ b/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n@@ -63,11 +63,11 @@\n @router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\n async def update_workspace(\n     workspace_id: str,\n     body: WorkspaceUpdate,\n-    user: AuthIdentity = Depends(require_workspace_member),\n+    user: AuthIdentity = Depends(_require_workspace_owner),  # see member-update-role advisory for helper\n     session: AsyncSession = Depends(get_db),\n ):\n     ws_svc = WorkspaceService(session)\n     ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)\n     if ws is None:\n         raise HTTPException(status_code=404, detail=\"Workspace not found\")\n     return WorkspaceResponse.model_validate(ws)\n```\n\nDefence-in-depth: validate the keys allowed in `body.settings` against an allowlist so the field cannot become an arbitrary config-injection primitive even for owners. The four companion workspace-mutation endpoints (`add_member`, `update_member_role`, `remove_member`, `delete_workspace`) exhibit the same default-min-role gap and are filed as their own advisories.",
  "id": "GHSA-rcmc-q9rj-4wmq",
  "modified": "2026-06-01T14:23:08Z",
  "published": "2026-06-01T14:23:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rcmc-q9rj-4wmq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-38280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-16T02:15:47Z",
    "severity": "HIGH"
  },
  "details": "IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell.  IBM X-Force ID:  260740.",
  "id": "GHSA-rcq5-59gf-jqxv",
  "modified": "2024-04-04T08:39:00Z",
  "published": "2023-10-16T03:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38280"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/260740"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7047713"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-41387"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-17T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.",
  "id": "GHSA-rcqm-vg32-925j",
  "modified": "2022-07-13T00:01:41Z",
  "published": "2022-05-24T19:14:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41387"
    },
    {
      "type": "WEB",
      "url": "https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CGJ2IZQ.HCKS1J0LSI803%40kl.wtf%3E"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}