CWE-280
AllowedImproper Handling of Insufficient Permissions or Privileges
Abstraction: Base · Status: Draft
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
259 vulnerabilities reference this CWE, most recent first.
GHSA-HR7M-HF2X-J4VH
Vulnerability from github – Published: 2025-12-12 21:31 – Updated: 2025-12-17 21:30A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3. An app may be able to gain root privileges.
{
"affected": [],
"aliases": [
"CVE-2025-43527"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-12T21:15:57Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3. An app may be able to gain root privileges.",
"id": "GHSA-hr7m-hf2x-j4vh",
"modified": "2025-12-17T21:30:44Z",
"published": "2025-12-12T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43527"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125886"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125887"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HWPP-2M5Q-2CW8
Vulnerability from github – Published: 2026-06-26 18:33 – Updated: 2026-06-26 21:32Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
{
"affected": [],
"aliases": [
"CVE-2026-45195"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T16:16:30Z",
"severity": "HIGH"
},
"details": "Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.\n\n\n\nAddresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.",
"id": "GHSA-hwpp-2m5q-2cw8",
"modified": "2026-06-26T21:32:15Z",
"published": "2026-06-26T18:33:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45195"
},
{
"type": "WEB",
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J5JV-W5CW-J9FF
Vulnerability from github – Published: 2026-02-03 12:30 – Updated: 2026-02-03 19:16A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0-beta"
},
{
"fixed": "4.4.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.5.0-beta"
},
{
"fixed": "4.5.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0-beta"
},
{
"fixed": "5.0.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0-beta"
},
{
"fixed": "5.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-67848"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-03T19:16:25Z",
"nvd_published_at": "2026-02-03T11:15:54Z",
"severity": "HIGH"
},
"details": "A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user\u0027s suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.",
"id": "GHSA-j5jv-w5cw-j9ff",
"modified": "2026-02-03T19:16:26Z",
"published": "2026-02-03T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67848"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/62f372e9d861d16df702d3c7726905fa2730e3d8"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/c2705e2c18962fec4f21b9c34ed386be2a379663"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-67848"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423831"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=471298"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moodle authentication bypass vulnerability"
}
GHSA-JHJM-5XJG-MPQP
Vulnerability from github – Published: 2023-03-21 21:30 – Updated: 2025-02-26 22:17Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.xuxueli:xxl-job"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"last_affected": "2.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-27087"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-21T22:41:55Z",
"nvd_published_at": "2023-03-21T19:15:00Z",
"severity": "HIGH"
},
"details": "Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.",
"id": "GHSA-jhjm-5xjg-mpqp",
"modified": "2025-02-26T22:17:31Z",
"published": "2023-03-21T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27087"
},
{
"type": "WEB",
"url": "https://github.com/xuxueli/xxl-job/issues/3096"
},
{
"type": "PACKAGE",
"url": "https://github.com/xuxueli/xxl-job"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter"
}
GHSA-JPGH-F7HM-PWMF
Vulnerability from github – Published: 2024-03-26 15:30 – Updated: 2024-03-26 15:30In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.
{
"affected": [],
"aliases": [
"CVE-2023-41972"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T15:15:48Z",
"severity": "HIGH"
},
"details": "In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later.",
"id": "GHSA-jpgh-f7hm-pwmf",
"modified": "2024-03-26T15:30:50Z",
"published": "2024-03-26T15:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41972"
},
{
"type": "WEB",
"url": "https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows\u0026applicable_version=4.3.0.121\u0026deployment_date=2023-09-01\u0026id=1463196"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JVRP-C78H-QQVJ
Vulnerability from github – Published: 2025-06-27 18:30 – Updated: 2025-07-01 18:30Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.
{
"affected": [],
"aliases": [
"CVE-2025-46708"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-27T17:15:33Z",
"severity": "MODERATE"
},
"details": "Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.",
"id": "GHSA-jvrp-c78h-qqvj",
"modified": "2025-07-01T18:30:35Z",
"published": "2025-06-27T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46708"
},
{
"type": "WEB",
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-M6F8-HJRV-MW5F
Vulnerability from github – Published: 2023-03-27 22:17 – Updated: 2023-03-27 22:17Impact
Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL. The URL includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource, and each of these can have arbitrary values.
While not trivial to exploit, it could be achieved by brute-forcing or guessing common names.
Access to the non-permitted API Keys could allow use of other users' resources without their permission (depending on the specifics of configuration, such as whether an API key is the only form of security).
Patches
Apiman 3.1.0.Final and later resolves this issue.
Workarounds
Only provide Apiman Manager accounts to known users, do not allow anonymous/unknown users to create an Apiman Manager account.
Note that this does not affect the Apiman Gateway.
References
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 3.0.0.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.apiman:apiman-manager-api-rest-impl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28640"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-280",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-27T22:17:57Z",
"nvd_published_at": "2023-03-27T21:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nDue to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL. The URL includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource, and each of these can have arbitrary values.\n\nWhile not trivial to exploit, it could be achieved by brute-forcing or guessing common names.\n\nAccess to the non-permitted API Keys could allow use of other users\u0027 resources without their permission (depending on the specifics of configuration, such as whether an API key is the only form of security).\n\n### Patches\n\nApiman 3.1.0.Final and later resolves this issue. \n\n### Workarounds\n\nOnly provide Apiman Manager accounts to known users, do not allow anonymous/unknown users to create an Apiman Manager account.\n\nNote that this does **not** affect the Apiman Gateway.\n\n### References\n\n* [Blog post disclosing issue](https://www.apiman.io/blog/potential-permissions-bypass-disclosure/)\n",
"id": "GHSA-m6f8-hjrv-mw5f",
"modified": "2023-03-27T22:17:57Z",
"published": "2023-03-27T22:17:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apiman/apiman/security/advisories/GHSA-m6f8-hjrv-mw5f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28640"
},
{
"type": "PACKAGE",
"url": "https://github.com/apiman/apiman"
},
{
"type": "WEB",
"url": "https://www.apiman.io/blog/potential-permissions-bypass-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apiman vulnerable to permissions bypass due to missing check on API key URL"
}
GHSA-M6HC-99RM-C9WC
Vulnerability from github – Published: 2026-06-09 15:32 – Updated: 2026-06-09 15:32When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.
{
"affected": [],
"aliases": [
"CVE-2026-11764"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T13:16:35Z",
"severity": "LOW"
},
"details": "When creating an export of all reusable media, the secrets of connected \ngift cards were included in the export even if the user creating the \nexport does not have permission to view gift cards. This is inconsistent\n with the UI and API where only the first letters of the gift card \nsecret are shown. Therefore, it allows circumventing a permission \nboundary.",
"id": "GHSA-m6hc-99rm-c9wc",
"modified": "2026-06-09T15:32:17Z",
"published": "2026-06-09T15:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11764"
},
{
"type": "WEB",
"url": "https://pretix.eu/about/en/blog/20260609-release-2026-5-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M6W2-P258-GXQP
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-07-02 21:32A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
{
"affected": [],
"aliases": [
"CVE-2026-2340"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:16:44Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Samba\u2019s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.",
"id": "GHSA-m6w2-p258-gxqp",
"modified": "2026-07-02T21:32:03Z",
"published": "2026-05-27T15:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22644"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22963"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25979"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28053"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28055"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28056"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28057"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:29863"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-2340"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
},
{
"type": "WEB",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=15997"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M8CJ-M32X-WPWV
Vulnerability from github – Published: 2022-02-08 00:00 – Updated: 2022-05-10 00:00NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-21814"
],
"database_specific": {
"cwe_ids": [
"CWE-280",
"CWE-755"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-07T20:15:00Z",
"severity": "MODERATE"
},
"details": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.",
"id": "GHSA-m8cj-m32x-wpwv",
"modified": "2022-05-10T00:00:49Z",
"published": "2022-02-08T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21814"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5312"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5321"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202310-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation
Always check to see if you have successfully accessed a resource or system functionality, and use proper error handling if it is unsuccessful. Do this even when you are operating in a highly privileged mode, because errors or environmental conditions might still cause a failure. For example, environments with highly granular permissions/privilege models, such as Windows or Linux capabilities, can cause unexpected failures.
No CAPEC attack patterns related to this CWE.