CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5632 vulnerabilities reference this CWE, most recent first.
GHSA-4XF3-WPM7-J6C9
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2022-05-24 17:08An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0753.
{
"affected": [],
"aliases": [
"CVE-2020-0754"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-11T22:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka \u0027Windows Error Reporting Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0753.",
"id": "GHSA-4xf3-wpm7-j6c9",
"modified": "2022-05-24T17:08:34Z",
"published": "2022-05-24T17:08:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0754"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0754"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4XH5-JCJ2-CH8Q
Vulnerability from github – Published: 2026-01-21 22:23 – Updated: 2026-01-22 15:40A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges.
After OIDC token claims are processed through CEL expressions, there is no validation that the resulting username and groups values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account's credentials instead of the authenticated user's limited permissions.
Impact
- Privilege Escalation: Any authenticated user can escalate to operator-level read permissions and perform suspend/resume/reconcile actions
- Data Exposure: Unauthorized read access to Flux resources across all namespaces, bypassing RBAC restrictions
- Information Disclosure: View sensitive GitOps pipeline configurations, source URLs, and deployment status across the entire cluster
Attack Scenario
Prerequisite: Cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., email, groups), or configure custom CEL expressions that can evaluate to empty values.
- Cluster admin configures OIDC authentication with a provider that does not include
emailorgroupsclaims in tokens - User authenticates with a valid token from that provider
- The default CEL expressions evaluate to empty values:
- Username:
has(claims.email) ? claims.email : ''→"" - Groups:
has(claims.groups) ? claims.groups : []→[] - Authentication succeeds (token signature is valid)
- A userClient is created with empty impersonation config
- All subsequent API requests bypass impersonation and execute as the flux-operator service account
- User gains operator-level read access across all namespaces
Patches
This vulnerability was fixed in Flux Operator v0.40.0.
Workarounds
The workaround is to make the email and groups claims required in the web config impersonation section.
Example config:
apiVersion: web.fluxcd.controlplane.io/v1
kind: Config
spec:
baseURL: https://flux.example.com
authentication:
type: OAuth2
oauth2:
provider: OIDC
clientID: "<redacted>"
clientSecret: "<redacted>"
issuerURL: "https://login.microsoftonline.com/<redacted>/v2.0"
scopes: [openid, profile, email, offline_access]
impersonation:
username: claims.email
groups: claims.groups
References
See the Pull Request fixing this vulnerability https://github.com/controlplaneio-fluxcd/flux-operator/pull/610
Credits
This vulnerability was discovered by the Flux Operator maintainers during a debugging session with end-users.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/controlplaneio-fluxcd/flux-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0.36.0"
},
{
"fixed": "0.40.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23990"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-21T22:23:33Z",
"nvd_published_at": "2026-01-21T23:15:52Z",
"severity": "MODERATE"
},
"details": "A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator\u0027s service account privileges.\n\nAfter OIDC token claims are processed through CEL expressions, there is no validation that the resulting `username` and `groups` values are non-empty. When both values are empty, the Kubernetes client-go library does not add impersonation headers to API requests, causing them to be executed with the flux-operator service account\u0027s credentials instead of the authenticated user\u0027s limited permissions.\n\n### Impact\n\n- **Privilege Escalation**: Any authenticated user can escalate to operator-level read permissions and perform suspend/resume/reconcile actions\n- **Data Exposure**: Unauthorized read access to Flux resources across all namespaces, bypassing RBAC restrictions\n- **Information Disclosure**: View sensitive GitOps pipeline configurations, source URLs, and deployment status across the entire cluster\n\n### Attack Scenario\n\n**Prerequisite**: Cluster admins must configure the Flux Operator with an OIDC provider that issues tokens lacking the expected claims (e.g., `email`, `groups`), or configure custom CEL expressions that can evaluate to empty values.\n\n1. Cluster admin configures OIDC authentication with a provider that does not include `email` or `groups` claims in tokens\n2. User authenticates with a valid token from that provider\n3. The default CEL expressions evaluate to empty values:\n - Username: `has(claims.email) ? claims.email : \u0027\u0027` \u2192 `\"\"`\n - Groups: `has(claims.groups) ? claims.groups : []` \u2192 `[]`\n4. Authentication succeeds (token signature is valid)\n5. A userClient is created with empty impersonation config\n6. All subsequent API requests bypass impersonation and execute as the flux-operator service account\n7. User gains operator-level read access across all namespaces\n\n### Patches\n\nThis vulnerability was fixed in Flux Operator v0.40.0.\n\n### Workarounds\n\nThe workaround is to make the `email` and `groups` claims required in the web config `impersonation` section.\n\nExample config:\n\n```yaml\napiVersion: web.fluxcd.controlplane.io/v1\nkind: Config\nspec:\n baseURL: https://flux.example.com\n authentication:\n type: OAuth2\n oauth2:\n provider: OIDC\n clientID: \"\u003credacted\u003e\"\n clientSecret: \"\u003credacted\u003e\"\n issuerURL: \"https://login.microsoftonline.com/\u003credacted\u003e/v2.0\"\n scopes: [openid, profile, email, offline_access]\n impersonation:\n username: claims.email\n groups: claims.groups\n```\n\n### References\n\nSee the Pull Request fixing this vulnerability https://github.com/controlplaneio-fluxcd/flux-operator/pull/610 \n\n### Credits\n\nThis vulnerability was discovered by the Flux Operator maintainers during a debugging session with end-users.",
"id": "GHSA-4xh5-jcj2-ch8q",
"modified": "2026-01-22T15:40:22Z",
"published": "2026-01-21T22:23:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/controlplaneio-fluxcd/flux-operator/security/advisories/GHSA-4xh5-jcj2-ch8q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23990"
},
{
"type": "WEB",
"url": "https://github.com/controlplaneio-fluxcd/flux-operator/pull/610"
},
{
"type": "WEB",
"url": "https://github.com/controlplaneio-fluxcd/flux-operator/commit/084540424f6de8ba5d88fb1fd1e8472ba29afd7e"
},
{
"type": "PACKAGE",
"url": "https://github.com/controlplaneio-fluxcd/flux-operator"
},
{
"type": "WEB",
"url": "https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.40.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims"
}
GHSA-4XJC-QQH2-PGWJ
Vulnerability from github – Published: 2021-12-02 00:00 – Updated: 2022-04-27 00:00The AMDPowerProfiler.sys driver of AMD ?Prof tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
{
"affected": [],
"aliases": [
"CVE-2021-26334"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-01T16:15:00Z",
"severity": "CRITICAL"
},
"details": "The AMDPowerProfiler.sys driver of AMD ?Prof tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.",
"id": "GHSA-4xjc-qqh2-pgwj",
"modified": "2022-04-27T00:00:50Z",
"published": "2021-12-02T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26334"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4XPH-HCW4-77X7
Vulnerability from github – Published: 2025-02-14 18:30 – Updated: 2025-02-14 21:31An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.
{
"affected": [],
"aliases": [
"CVE-2024-57778"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T16:15:34Z",
"severity": "MODERATE"
},
"details": "An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.",
"id": "GHSA-4xph-hcw4-77x7",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-14T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57778"
},
{
"type": "WEB",
"url": "https://github.com/KUK3N4N/CVE-2024-57778"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4XPH-R595-WP4R
Vulnerability from github – Published: 2021-11-21 00:00 – Updated: 2024-02-27 19:03Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system.
{
"affected": [],
"aliases": [
"CVE-2021-36307"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-20T02:15:00Z",
"severity": "HIGH"
},
"details": "Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains a privilege escalation vulnerability. A malicious low privileged user with specific access to the API could potentially exploit this vulnerability to gain admin privileges on the affected system.",
"id": "GHSA-4xph-r595-wp4r",
"modified": "2024-02-27T19:03:42Z",
"published": "2021-11-21T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36307"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000193076"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4XPQ-67Q3-73XV
Vulnerability from github – Published: 2021-12-16 00:00 – Updated: 2022-07-13 00:01In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031401
{
"affected": [],
"aliases": [
"CVE-2021-1019"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-15T19:15:00Z",
"severity": "HIGH"
},
"details": "In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195031401",
"id": "GHSA-4xpq-67q3-73xv",
"modified": "2022-07-13T00:01:00Z",
"published": "2021-12-16T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1019"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2021-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4XQF-WPGP-683P
Vulnerability from github – Published: 2022-05-24 17:14 – Updated: 2022-05-24 17:14An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0996.
{
"affected": [],
"aliases": [
"CVE-2020-0985"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-15T15:15:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka \u0027Windows Update Stack Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0996.",
"id": "GHSA-4xqf-wpgp-683p",
"modified": "2022-05-24T17:14:34Z",
"published": "2022-05-24T17:14:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0985"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0985"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4XR4-3F5P-7CG4
Vulnerability from github – Published: 2023-08-08 09:30 – Updated: 2025-02-13 18:31In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2023-4009"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-648"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-08T09:15:11Z",
"severity": "HIGH"
},
"details": "In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.",
"id": "GHSA-4xr4-3f5p-7cg4",
"modified": "2025-02-13T18:31:45Z",
"published": "2023-08-08T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4009"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230831-0013"
},
{
"type": "WEB",
"url": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-6-0"
},
{
"type": "WEB",
"url": "https://www.mongodb.com/docs/ops-manager/v5.0/release-notes/application/#onprem-server-5-0-22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4XRH-5M3M-328W
Vulnerability from github – Published: 2026-05-21 20:44 – Updated: 2026-05-21 20:44Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation.
Patched in 1.3.2: the validator inspects the affected policy shapes and includes regression tests.
Remediation: upgrade @hulumi/policies to 1.3.2 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@hulumi/policies"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-21T20:44:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Impact: @hulumi/policies versions before 1.3.2 did not fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail, so some admin-equivalent policy paths could pass policy evaluation.\n\nPatched in 1.3.2: the validator inspects the affected policy shapes and includes regression tests.\n\nRemediation: upgrade @hulumi/policies to 1.3.2 or later.",
"id": "GHSA-4xrh-5m3m-328w",
"modified": "2026-05-21T20:44:12Z",
"published": "2026-05-21T20:44:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-4xrh-5m3m-328w"
},
{
"type": "PACKAGE",
"url": "https://github.com/kerberosmansour/hulumi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies"
}
GHSA-4XXW-JX52-QF53
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-16 00:00Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26802, CVE-2022-26803.
{
"affected": [],
"aliases": [
"CVE-2022-26801"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T19:15:00Z",
"severity": "HIGH"
},
"details": "Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-26786, CVE-2022-26787, CVE-2022-26789, CVE-2022-26790, CVE-2022-26791, CVE-2022-26792, CVE-2022-26793, CVE-2022-26794, CVE-2022-26795, CVE-2022-26796, CVE-2022-26797, CVE-2022-26798, CVE-2022-26802, CVE-2022-26803.",
"id": "GHSA-4xxw-jx52-qf53",
"modified": "2022-04-16T00:00:33Z",
"published": "2022-04-16T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26801"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26801"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26801"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.