CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5632 vulnerabilities reference this CWE, most recent first.
GHSA-569P-VMXP-HG5X
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-07-13 00:01Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the system to escalate privileges and create a denial of service.
{
"affected": [],
"aliases": [
"CVE-2021-36744"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-06T12:15:00Z",
"severity": "HIGH"
},
"details": "Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the system to escalate privileges and create a denial of service.",
"id": "GHSA-569p-vmxp-hg5x",
"modified": "2022-07-13T00:01:30Z",
"published": "2022-05-24T19:13:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36744"
},
{
"type": "WEB",
"url": "https://helpcenter.trendmicro.com/en-us/article/tmka-10568"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1052"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-56MX-8G9F-5CRF
Vulnerability from github – Published: 2025-11-13 16:04 – Updated: 2026-03-30 13:54Impact
This affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true as well as access to the host as an unprivileged user.
The most common case for this would be systems using incus-user with the less privileged incus group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unpriivleged user on the host to gain root privileges.
Patches
A patch for this issue is available here: https://github.com/lxc/incus/pull/2642
The first commit changes the permissions for any new storage pool, the second commit applies it on startup to all existing storage pools.
Workarounds
Permissions can be manually restricted until a patched version of Incus is deployed.
This is done with:
chmod 0700 /var/lib/incus/storage-pools/*/*
chmod 0711 /var/lib/incus/storage-pools/*/buckets*
chmod 0711 /var/lib/incus/storage-pools/*/container*
Those are the same permissions which will be applied by the patched Incus for both new and existing storage pools.
References
This was reported publicly on Github by here: https://github.com/lxc/incus/issues/2641
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.18.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.19.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64507"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-13T16:04:55Z",
"nvd_published_at": "2025-11-10T22:15:39Z",
"severity": "HIGH"
},
"details": "### Impact\nThis affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user.\n\nThe most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unpriivleged user on the host to gain root privileges.\n\n### Patches\nA patch for this issue is available here: https://github.com/lxc/incus/pull/2642\n\nThe first commit changes the permissions for any new storage pool, the second commit applies it on startup to all existing storage pools.\n\n### Workarounds\nPermissions can be manually restricted until a patched version of Incus is deployed.\n\nThis is done with:\n\n```\nchmod 0700 /var/lib/incus/storage-pools/*/*\nchmod 0711 /var/lib/incus/storage-pools/*/buckets*\nchmod 0711 /var/lib/incus/storage-pools/*/container*\n```\n\nThose are the same permissions which will be applied by the patched Incus for both new and existing storage pools.\n\n### References\nThis was reported publicly on Github by here: https://github.com/lxc/incus/issues/2641",
"id": "GHSA-56mx-8g9f-5crf",
"modified": "2026-03-30T13:54:58Z",
"published": "2025-11-13T16:04:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64507"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/issues/2641"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/pull/2642"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxc/incus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Incus vulnerable to local privilege escalation through custom storage volumes"
}
GHSA-5738-V2HJ-J4XC
Vulnerability from github – Published: 2023-10-30 18:30 – Updated: 2023-11-07 03:30In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2023-21397"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-30T18:15:09Z",
"severity": "HIGH"
},
"details": "In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-5738-v2hj-j4xc",
"modified": "2023-11-07T03:30:26Z",
"published": "2023-10-30T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21397"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/android-14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5743-8C5X-VR2C
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1207, CVE-2020-1247, CVE-2020-1251, CVE-2020-1310.
{
"affected": [],
"aliases": [
"CVE-2020-1253"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-09T20:15:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka \u0027Win32k Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1207, CVE-2020-1247, CVE-2020-1251, CVE-2020-1310.",
"id": "GHSA-5743-8c5x-vr2c",
"modified": "2022-05-24T17:19:53Z",
"published": "2022-05-24T17:19:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1253"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1253"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5743-P3XC-XMHV
Vulnerability from github – Published: 2023-11-29 18:30 – Updated: 2023-12-05 18:30In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.
{
"affected": [],
"aliases": [
"CVE-2023-6218"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-29T17:15:07Z",
"severity": "HIGH"
},
"details": "\nIn Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.\u00a0 It is possible for a group administrator to elevate a group members permissions to the role of an organization\u00a0administrator.\n",
"id": "GHSA-5743-p3xc-xmhv",
"modified": "2023-12-05T18:30:22Z",
"published": "2023-11-29T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6218"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023"
},
{
"type": "WEB",
"url": "https://www.progress.com/moveit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-578J-G69C-M62R
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
{
"affected": [],
"aliases": [
"CVE-2020-7125"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-26T16:15:00Z",
"severity": "HIGH"
},
"details": "A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.",
"id": "GHSA-578j-g69c-m62r",
"modified": "2022-05-24T17:32:12Z",
"published": "2022-05-24T17:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7125"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04051en_us"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5795-QV38-9394
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-16 00:01A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.
{
"affected": [],
"aliases": [
"CVE-2022-0556"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T12:15:00Z",
"severity": "HIGH"
},
"details": "A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.",
"id": "GHSA-5795-qv38-9394",
"modified": "2022-04-16T00:01:13Z",
"published": "2022-04-12T00:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0556"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-local-privilege-escalation-vulnerability-of-AP-Configurator.shtml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-579H-MV94-G4GP
Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2021-05-20 20:40In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubernetes/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubernetes/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.11.0"
},
{
"fixed": "1.11.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubernetes/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1002105"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-20T20:40:04Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server\u0027s TLS credentials used to establish the backend connection.",
"id": "GHSA-579h-mv94-g4gp",
"modified": "2021-05-20T20:40:04Z",
"published": "2022-02-15T01:57:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1002105"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/71411"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/commit/2257c1ecbe3c0cf71dd50b82752ae189c94ec905"
},
{
"type": "WEB",
"url": "https://www.securityfocus.com/bid/106068"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2019/07/06/4"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2019/07/06/3"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2019/06/28/2"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46053"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46052"
},
{
"type": "WEB",
"url": "https://www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190416-0001"
},
{
"type": "WEB",
"url": "https://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/kubernetes-announce/GVllWCg6L88"
},
{
"type": "WEB",
"url": "https://github.com/evict/poc_CVE-2018-1002105"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3754"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3752"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3742"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3624"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3598"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3537"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Privilege Escalation in Kubernetes"
}
GHSA-57C8-7JWM-WC5W
Vulnerability from github – Published: 2024-07-17 18:31 – Updated: 2025-04-10 15:31A flaw exists in Purity//FB whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.
{
"affected": [],
"aliases": [
"CVE-2023-4976"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-17T16:15:03Z",
"severity": "CRITICAL"
},
"details": "A flaw exists in Purity//FB whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.",
"id": "GHSA-57c8-7jwm-wc5w",
"modified": "2025-04-10T15:31:37Z",
"published": "2024-07-17T18:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4976"
},
{
"type": "WEB",
"url": "https://purestorage.com/security"
},
{
"type": "WEB",
"url": "https://www.purestorage.com/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-57H9-733X-V43Q
Vulnerability from github – Published: 2024-05-15 00:30 – Updated: 2024-05-15 00:30Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.
{
"affected": [],
"aliases": [
"CVE-2023-33327"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T22:15:08Z",
"severity": "HIGH"
},
"details": "Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.\n\n",
"id": "GHSA-57h9-733x-v43q",
"modified": "2024-05-15T00:30:36Z",
"published": "2024-05-15T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33327"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-29-2-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.