CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5430 vulnerabilities reference this CWE, most recent first.
GHSA-XX4W-VP73-2842
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users on a Windows platform to elevate their privileges. A successful exploit could allow an attacker to execute arbitrary code with SYSTEM level privileges.
{
"affected": [],
"aliases": [
"CVE-2021-26677"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-23T19:15:00Z",
"severity": "HIGH"
},
"details": "A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in ClearPass OnGuard could allow local authenticated users on a Windows platform to elevate their privileges. A successful exploit could allow an attacker to execute arbitrary code with SYSTEM level privileges.",
"id": "GHSA-xx4w-vp73-2842",
"modified": "2022-05-24T17:42:55Z",
"published": "2022-05-24T17:42:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26677"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-004.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX58-82Q7-25FR
Vulnerability from github – Published: 2024-02-09 00:31 – Updated: 2024-02-15 18:30An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.
{
"affected": [],
"aliases": [
"CVE-2023-47132"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-08T23:15:09Z",
"severity": "CRITICAL"
},
"details": "An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.",
"id": "GHSA-xx58-82q7-25fr",
"modified": "2024-02-15T18:30:40Z",
"published": "2024-02-09T00:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47132"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/security-advisory/aArHs000000M8CHKA0/cve202347132-ncentral-api-privilege-escalation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX67-MJ7C-3WVG
Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-08-06 00:00Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.
{
"affected": [],
"aliases": [
"CVE-2021-1223"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-693"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-13T22:15:00Z",
"severity": "HIGH"
},
"details": "Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.",
"id": "GHSA-xx67-mj7c-3wvg",
"modified": "2022-08-06T00:00:37Z",
"published": "2022-05-24T17:39:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1223"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-filepolbypass-67DEwMe2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5354"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XX83-6GM8-XX8P
Vulnerability from github – Published: 2024-08-16 00:32 – Updated: 2024-08-16 18:30In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock screen visibility settings are restricted by the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-34741"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z",
"severity": "HIGH"
},
"details": "In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaver while lock screen visibility settings are restricted by the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-xx83-6gm8-xx8p",
"modified": "2024-08-16T18:30:57Z",
"published": "2024-08-16T00:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34741"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/abfaf702ef833dc4d374492d45c615c6e6de7f01"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX83-GQ5V-8PRV
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2024-01-01 00:30An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1308.
{
"affected": [],
"aliases": [
"CVE-2020-1053"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-11T17:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka \u0027DirectX Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1308.",
"id": "GHSA-xx83-gq5v-8prv",
"modified": "2024-01-01T00:30:40Z",
"published": "2022-05-24T17:27:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1053"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1053"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX8W-MQ23-29G4
Vulnerability from github – Published: 2024-02-01 19:21 – Updated: 2024-02-01 22:52Summary
When someone creates an access key, it inherits the permissions of the parent key. Not only for
s3:* actions, but also admin:* actions. Which means unless somewhere above in the
access-key hierarchy, the admin rights are denied, access keys will be able to simply
override their own s3 permissions to something more permissive.
Credit to @xSke for sort of accidentally discovering this. I only understood the implications.
Details / PoC
We spun up the latest version of minio in a docker container and signed in to the admin UI
using the minio root user. We created two buckets, public and private and created an
access key called mycat and attached the following policy to only allow access to the
bucket called public.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::public",
"arn:aws:s3:::public/*"
]
}
]
}
We then set an alias in mc: mcli alias set vuln http://localhost:9001 mycat mycatiscute
And checked whether policy works:
A ~/c/minio-vuln mcli ls vuln
[0001-01-01 00:53:28 LMT] 0B public/
Looks good, we believe this is how 99% of users will work with access policies.
If I now create a file full-access-policy.json:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}
And then:
A ~/c/minio-vuln mcli admin user svcacct edit --policy full-access-policy.json vuln mycat
Edited service account `mycat` successfully.
mycat has escalated its privileges to get access to the entire deployment:
A ~/c/minio-vuln mcli ls vuln
[0001-01-01 00:53:28 LMT] 0B private/
[0001-01-01 00:53:28 LMT] 0B public/
Impact
A trivial privilege escalation unless the operator fully understands that they need to
explicitly deny admin actions on access keys.
Patched
commit 0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776 (HEAD -> master, origin/master)
Author: Aditya Manthramurthy <donatello@users.noreply.github.com>
Date: Wed Jan 31 10:56:45 2024 -0800
fix: permission checks for editing access keys (#18928)
With this change, only a user with `UpdateServiceAccountAdminAction`
permission is able to edit access keys.
We would like to let a user edit their own access keys, however the
feature needs to be re-designed for better security and integration with
external systems like AD/LDAP and OpenID.
This change prevents privilege escalation via service accounts.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/minio/minio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20240131185645-0ae4915a9391"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-24747"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-01T19:21:30Z",
"nvd_published_at": "2024-01-31T22:15:54Z",
"severity": "HIGH"
},
"details": "### Summary\nWhen someone creates an access key, it inherits the permissions of the parent key. Not only for \n`s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the \naccess-key hierarchy, the `admin` rights are denied, access keys will be able to simply \noverride their own `s3` permissions to something more permissive.\n\nCredit to @xSke for sort of accidentally discovering this. I only understood the implications.\n\n### Details / PoC\nWe spun up the latest version of minio in a docker container and signed in to the admin UI \nusing the minio root user. We created two buckets, `public` and `private` and created an \naccess key called `mycat` and attached the following policy to only allow access to the \nbucket called `public`.\n\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:*\"\n ],\n \"Resource\": [\n \"arn:aws:s3:::public\",\n \"arn:aws:s3:::public/*\"\n ]\n }\n ]\n}\n```\nWe then set an alias in mc: `mcli alias set vuln http://localhost:9001 mycat mycatiscute` \n\nAnd checked whether policy works:\n```\nA ~/c/minio-vuln mcli ls vuln\n[0001-01-01 00:53:28 LMT] 0B public/\n```\nLooks good, we believe this is how 99% of users will work with access policies.\n\nIf I now create a file `full-access-policy.json`:\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:*\"\n ],\n \"Resource\": [\n \"arn:aws:s3:::*\"\n ]\n }\n ]\n}\n```\nAnd then:\n\n```sh\nA ~/c/minio-vuln mcli admin user svcacct edit --policy full-access-policy.json vuln mycat\nEdited service account `mycat` successfully.\n```\n`mycat` has escalated its privileges to get access to the entire deployment: \n```sh\nA ~/c/minio-vuln mcli ls vuln\n[0001-01-01 00:53:28 LMT] 0B private/\n[0001-01-01 00:53:28 LMT] 0B public/\n```\n\n### Impact\nA trivial privilege escalation unless the operator fully understands that they need to \nexplicitly deny `admin` actions on access keys. \n\n### Patched\n\n```\ncommit 0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776 (HEAD -\u003e master, origin/master)\nAuthor: Aditya Manthramurthy \u003cdonatello@users.noreply.github.com\u003e\nDate: Wed Jan 31 10:56:45 2024 -0800\n\n fix: permission checks for editing access keys (#18928)\n \n With this change, only a user with `UpdateServiceAccountAdminAction`\n permission is able to edit access keys.\n \n We would like to let a user edit their own access keys, however the\n feature needs to be re-designed for better security and integration with\n external systems like AD/LDAP and OpenID.\n \n This change prevents privilege escalation via service accounts.\n```\n",
"id": "GHSA-xx8w-mq23-29g4",
"modified": "2024-02-01T22:52:18Z",
"published": "2024-02-01T19:21:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24747"
},
{
"type": "WEB",
"url": "https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776"
},
{
"type": "PACKAGE",
"url": "https://github.com/minio/minio"
},
{
"type": "WEB",
"url": "https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation"
}
GHSA-XX9P-C4JQ-4CFF
Vulnerability from github – Published: 2024-01-23 21:30 – Updated: 2025-06-20 21:31An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-52337"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:09Z",
"severity": "HIGH"
},
"details": "An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-xx9p-c4jq-4cff",
"modified": "2025-06-20T21:31:51Z",
"published": "2024-01-23T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52337"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/dcx/s/solution/000296337?language=en_US"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-075"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XXJW-6QX2-CRCM
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2023-11-15 21:35Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a low privileged user.
{
"affected": [],
"aliases": [
"CVE-2021-31836"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-22T14:15:00Z",
"severity": "HIGH"
},
"details": "Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a low privileged user.",
"id": "GHSA-xxjw-6qx2-crcm",
"modified": "2023-11-15T21:35:02Z",
"published": "2022-05-24T19:15:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31836"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10369"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXVC-6XWM-7PRP
Vulnerability from github – Published: 2025-06-04 15:30 – Updated: 2025-06-04 21:31A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escalate their privileges via a vulnerable COM interface in the target service.
{
"affected": [],
"aliases": [
"CVE-2025-27811"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-04T14:15:28Z",
"severity": "HIGH"
},
"details": "A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escalate their privileges via a vulnerable COM interface in the target service.",
"id": "GHSA-xxvc-6xwm-7prp",
"modified": "2025-06-04T21:31:14Z",
"published": "2025-06-04T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27811"
},
{
"type": "WEB",
"url": "https://app.inspectiv.com/#/submissions/EAEDG9ssRaTWKSJJ5Bbrt9"
},
{
"type": "WEB",
"url": "https://gist.github.com/leonjza/829a98f6c0954d7cb3f6614d05f87f37"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XXX7-J74C-5XRG
Vulnerability from github – Published: 2026-03-11 21:31 – Updated: 2026-03-11 21:31During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes.
{
"affected": [],
"aliases": [
"CVE-2026-2640"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T21:16:15Z",
"severity": "MODERATE"
},
"details": "During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes.",
"id": "GHSA-xxx7-j74c-5xrg",
"modified": "2026-03-11T21:31:04Z",
"published": "2026-03-11T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2640"
},
{
"type": "WEB",
"url": "https://iknow.lenovo.com.cn/detail/438816"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.