CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5632 vulnerabilities reference this CWE, most recent first.
GHSA-4J59-HFW6-6W7H
Vulnerability from github – Published: 2018-08-15 19:30 – Updated: 2021-09-16 20:54Affected versions of cmake insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running cmake.
Recommendation
No patch is currently available for this vulnerability.
The best mitigation is currently to avoid using this package, using a different package if available, or installing the cmake binaries via a system package manager, such as apt-get.
Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "cmake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10642"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-311"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:58:24Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of `cmake` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cmake`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability.\n\nThe best mitigation is currently to avoid using this package, using a different package if available, or installing the cmake binaries via a system package manager, such as `apt-get`.\n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
"id": "GHSA-4j59-hfw6-6w7h",
"modified": "2021-09-16T20:54:42Z",
"published": "2018-08-15T19:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10642"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4j59-hfw6-6w7h"
},
{
"type": "PACKAGE",
"url": "https://github.com/stanley-gu/cmake"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/233"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Downloads Resources over HTTP in cmake"
}
GHSA-4J74-6CG6-QVQF
Vulnerability from github – Published: 2026-07-14 15:32 – Updated: 2026-07-14 15:32Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows.
This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.
{
"affected": [],
"aliases": [
"CVE-2026-53565"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T13:18:58Z",
"severity": "HIGH"
},
"details": "Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows.\n\nThis issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.",
"id": "GHSA-4j74-6cg6-qvqf",
"modified": "2026-07-14T15:32:16Z",
"published": "2026-07-14T15:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53565"
},
{
"type": "WEB",
"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696734"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4J9V-XRV3-FMC2
Vulnerability from github – Published: 2022-08-10 00:00 – Updated: 2022-08-10 00:00Active Directory Domain Services Elevation of Privilege Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-34691"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-09T20:15:00Z",
"severity": "HIGH"
},
"details": "Active Directory Domain Services Elevation of Privilege Vulnerability.",
"id": "GHSA-4j9v-xrv3-fmc2",
"modified": "2022-08-10T00:00:18Z",
"published": "2022-08-10T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34691"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34691"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-34691"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4JCR-VF56-7RJC
Vulnerability from github – Published: 2022-12-23 21:30 – Updated: 2022-12-31 03:30IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges. IBM X-Force ID: 236690.
{
"affected": [],
"aliases": [
"CVE-2022-41290"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-23T20:15:00Z",
"severity": "HIGH"
},
"details": "IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges. IBM X-Force ID: 236690.",
"id": "GHSA-4jcr-vf56-7rjc",
"modified": "2022-12-31T03:30:27Z",
"published": "2022-12-23T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41290"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/236690"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6847917"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4JGP-67CJ-X7V5
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2025-04-20 03:49ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
{
"affected": [],
"aliases": [
"CVE-2017-17384"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-07T08:29:00Z",
"severity": "HIGH"
},
"details": "ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.",
"id": "GHSA-4jgp-67cj-x7v5",
"modified": "2025-04-20T03:49:36Z",
"published": "2022-05-13T01:44:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17384"
},
{
"type": "WEB",
"url": "https://www.ispconfig.org/blog/ispconfig-3-1-9-released-important-security-update"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4JH2-3C85-Q67H
Vulnerability from github – Published: 2022-01-28 21:55 – Updated: 2024-09-03 21:38In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-45230"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-27T23:12:43Z",
"nvd_published_at": "2022-01-20T11:15:00Z",
"severity": "MODERATE"
},
"details": "In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has \"can_create\" permissions on DAG Runs can create Dag Runs for dags that they don\u0027t have \"edit\" permissions for.",
"id": "GHSA-4jh2-3c85-q67h",
"modified": "2024-09-03T21:38:43Z",
"published": "2022-01-28T21:55:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45230"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-11.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Privilege Management in apache-airflow"
}
GHSA-4JPW-HJ22-2XMC
Vulnerability from github – Published: 2026-03-13 15:47 – Updated: 2026-03-13 15:47Summary
In affected versions of openclaw, a caller holding only operator.pairing could use device.token.rotate to mint a new token with broader scopes for an already paired device. If the target device was approved for operator.admin, the attacker could obtain an administrative token without already holding administrative scope.
Impact
This is a critical authorization flaw. On deployments with connected node hosts or companion apps that expose system.run, the escalated token could then modify node execution approvals and reach real remote code execution on the node. Even without nodes, the flaw still granted unauthorized gateway-admin access.
Affected Packages and Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.3.8 - Fixed in:
2026.3.11
Technical Details
device.token.rotate accepted caller-supplied target scopes and validated them against the target device's approved scopes, but it did not constrain the newly minted scopes to the caller's own current scope set. That allowed a pairing-scoped caller to mint a broader token for an already paired administrative device.
Fix
OpenClaw now enforces caller-scope subsetting in device.token.rotate, preventing callers from minting device tokens broader than the scopes they already hold. The fix shipped in openclaw@2026.3.11.
Workarounds
Upgrade to 2026.3.11 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-13T15:47:29Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Summary\nIn affected versions of `openclaw`, a caller holding only `operator.pairing` could use `device.token.rotate` to mint a new token with broader scopes for an already paired device. If the target device was approved for `operator.admin`, the attacker could obtain an administrative token without already holding administrative scope.\n\n## Impact\nThis is a critical authorization flaw. On deployments with connected node hosts or companion apps that expose `system.run`, the escalated token could then modify node execution approvals and reach real remote code execution on the node. Even without nodes, the flaw still granted unauthorized gateway-admin access.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\n`device.token.rotate` accepted caller-supplied target scopes and validated them against the target device\u0027s approved scopes, but it did not constrain the newly minted scopes to the caller\u0027s own current scope set. That allowed a pairing-scoped caller to mint a broader token for an already paired administrative device.\n\n## Fix\nOpenClaw now enforces caller-scope subsetting in `device.token.rotate`, preventing callers from minting device tokens broader than the scopes they already hold. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
"id": "GHSA-4jpw-hj22-2xmc",
"modified": "2026-03-13T15:47:29Z",
"published": "2026-03-13T15:47:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE"
}
GHSA-4JRW-3Q8X-9GPF
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-09-15 00:00An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.2. Inproper use of access validation allows a logged in user to see devices in the account he should not have access to.
{
"affected": [],
"aliases": [
"CVE-2020-35557"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-16T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.2. Inproper use of access validation allows a logged in user to see devices in the account he should not have access to.",
"id": "GHSA-4jrw-3q8x-9gpf",
"modified": "2022-09-15T00:00:21Z",
"published": "2022-05-24T17:42:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35557"
},
{
"type": "WEB",
"url": "https://cert.vde.com/de-de/advisories/vde-2021-003"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2021-003"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2022-039"
},
{
"type": "WEB",
"url": "https://mbconnectline.com/security-advice"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4JX6-C96P-4MCX
Vulnerability from github – Published: 2022-09-25 00:00 – Updated: 2022-09-29 00:00This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8. An app with root privileges may be able to access private information.
{
"affected": [],
"aliases": [
"CVE-2022-32781"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-23T19:15:00Z",
"severity": "MODERATE"
},
"details": "This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8. An app with root privileges may be able to access private information.",
"id": "GHSA-4jx6-c96p-4mcx",
"modified": "2022-09-29T00:00:27Z",
"published": "2022-09-25T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32781"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213257"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213258"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213343"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213344"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4M4C-MM78-3PCW
Vulnerability from github – Published: 2022-09-25 00:00 – Updated: 2022-09-28 00:00This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.
{
"affected": [],
"aliases": [
"CVE-2022-32829"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-23T19:15:00Z",
"severity": "HIGH"
},
"details": "This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.",
"id": "GHSA-4m4c-mm78-3pcw",
"modified": "2022-09-28T00:00:21Z",
"published": "2022-09-25T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32829"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213345"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213346"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.