CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
6495 vulnerabilities reference this CWE, most recent first.
GHSA-3X5G-35P7-8PPC
Vulnerability from github – Published: 2026-08-18 21:33 – Updated: 2026-08-18 21:33Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
{
"affected": [],
"aliases": [
"CVE-2026-70943"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T21:17:52Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).",
"id": "GHSA-3x5g-35p7-8ppc",
"modified": "2026-08-18T21:33:15Z",
"published": "2026-08-18T21:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70943"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3X65-293M-45MC
Vulnerability from github – Published: 2022-03-31 00:00 – Updated: 2022-04-06 00:01In Telecomm, there is a possible way to determine whether an app is installed, without query permissions, due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-196406138
{
"affected": [],
"aliases": [
"CVE-2021-39778"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-30T16:15:00Z",
"severity": "MODERATE"
},
"details": "In Telecomm, there is a possible way to determine whether an app is installed, without query permissions, due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-196406138",
"id": "GHSA-3x65-293m-45mc",
"modified": "2022-04-06T00:01:50Z",
"published": "2022-03-31T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39778"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-12l"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3X65-V85X-F94H
Vulnerability from github – Published: 2026-08-27 21:31 – Updated: 2026-09-01 21:31An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
{
"affected": [],
"aliases": [
"CVE-2026-36102"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T20:17:40Z",
"severity": "HIGH"
},
"details": "An issue in the inviteController.js component in Bluewave Labs Checkmate \u003c=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.",
"id": "GHSA-3x65-v85x-f94h",
"modified": "2026-09-01T21:31:26Z",
"published": "2026-08-27T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-36102"
},
{
"type": "WEB",
"url": "https://gist.github.com/Joren2087/cc60f1c8dfe0680c1e5e867b70703e22"
},
{
"type": "WEB",
"url": "https://outline.joren2087.be/s/f02631bd-cddd-4e59-952b-0e756cdc8fba"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3X7W-VVG2-W6R8
Vulnerability from github – Published: 2023-07-10 18:30 – Updated: 2024-10-16 12:30Local users are able to execute scripts under root privileges.
{
"affected": [],
"aliases": [
"CVE-2021-42082"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-10T16:15:47Z",
"severity": "HIGH"
},
"details": "Local users are able to execute scripts under root privileges.",
"id": "GHSA-3x7w-vvg2-w6r8",
"modified": "2024-10-16T12:30:47Z",
"published": "2023-07-10T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42082"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2021-42082"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2021-00020"
},
{
"type": "WEB",
"url": "https://www.divd.nl/DIVD-2021-00020"
},
{
"type": "WEB",
"url": "https://www.osnexus.com/products/software-defined-storage"
},
{
"type": "WEB",
"url": "https://www.wbsec.nl/osnexus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3XQ5-VW38-Q48P
Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
{
"affected": [],
"aliases": [
"CVE-2026-62561"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:19:09Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"id": "GHSA-3xq5-vw38-q48p",
"modified": "2026-07-22T00:32:34Z",
"published": "2026-07-22T00:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62561"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3XQ6-3W4G-4J37
Vulnerability from github – Published: 2022-05-24 17:14 – Updated: 2022-05-24 17:14A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to execute code with elevated privileges.
{
"affected": [],
"aliases": [
"CVE-2020-8319"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-14T21:15:00Z",
"severity": "HIGH"
},
"details": "A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to execute code with elevated privileges.",
"id": "GHSA-3xq6-3w4g-4j37",
"modified": "2022-05-24T17:14:18Z",
"published": "2022-05-24T17:14:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8319"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-30401"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3XR8-Q83F-2WQP
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-24 17:07mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently.
{
"affected": [],
"aliases": [
"CVE-2020-7221"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-04T17:15:00Z",
"severity": "HIGH"
},
"details": "mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently.",
"id": "GHSA-3xr8-q83f-2wqp",
"modified": "2022-05-24T17:07:59Z",
"published": "2022-05-24T17:07:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7221"
},
{
"type": "WEB",
"url": "https://github.com/MariaDB/server/commit/9d18b6246755472c8324bf3e20e234e08ac45618"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1160868"
},
{
"type": "WEB",
"url": "https://seclists.org/oss-sec/2020/q1/55"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3XV6-7VVV-6F5V
Vulnerability from github – Published: 2024-10-04 18:31 – Updated: 2024-10-08 18:33An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows a remote attacker to escalate privileges via the open port.
{
"affected": [],
"aliases": [
"CVE-2024-44439"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-04T18:15:08Z",
"severity": "MODERATE"
},
"details": "An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows a remote attacker to escalate privileges via the open port.",
"id": "GHSA-3xv6-7vvv-6f5v",
"modified": "2024-10-08T18:33:13Z",
"published": "2024-10-04T18:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44439"
},
{
"type": "WEB",
"url": "https://smiling-lemonade-122.notion.site/f7da442e0f8a40fc846eea495dcdd329"
},
{
"type": "WEB",
"url": "https://www.notion.so/f7da442e0f8a40fc846eea495dcdd329?pvs=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3XVR-7CQM-9J53
Vulnerability from github – Published: 2024-04-29 21:30 – Updated: 2024-08-22 21:31An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:\Program Files\SUPERAntiSpyware folder.
{
"affected": [],
"aliases": [
"CVE-2024-27518"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T21:15:47Z",
"severity": "HIGH"
},
"details": "An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:\\Program Files\\SUPERAntiSpyware folder.",
"id": "GHSA-3xvr-7cqm-9j53",
"modified": "2024-08-22T21:31:28Z",
"published": "2024-04-29T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27518"
},
{
"type": "WEB",
"url": "https://github.com/secunnix/CVE-2024-27518"
},
{
"type": "WEB",
"url": "https://www.superantispyware.com"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=FM5XlZPdvdo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-422M-5RG7-4PVV
Vulnerability from github – Published: 2022-07-13 00:00 – Updated: 2022-07-13 00:00Windows Fast FAT File System Driver Elevation of Privilege Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-22043"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-12T23:15:00Z",
"severity": "HIGH"
},
"details": "Windows Fast FAT File System Driver Elevation of Privilege Vulnerability.",
"id": "GHSA-422m-5rg7-4pvv",
"modified": "2022-07-13T00:00:39Z",
"published": "2022-07-13T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22043"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22043"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.