CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-CHC6-3MHW-PC4R
Vulnerability from github – Published: 2025-01-27 06:30 – Updated: 2025-01-27 06:30An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions.
This issue affects:
-
OTRS 7.0.X
-
OTRS 8.0.X
- OTRS 2023.X
-
OTRS 2024.X
-
((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
{
"affected": [],
"aliases": [
"CVE-2024-43446"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-27T06:15:24Z",
"severity": "LOW"
},
"details": "An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. \n\nThis issue affects: \n\n * OTRS 7.0.X\n\n * OTRS 8.0.X\n * OTRS 2023.X\n * OTRS 2024.X\n\n * ((OTRS)) Community Edition: 6.0.x\n\nProducts based on the ((OTRS)) Community Edition also very likely to be affected",
"id": "GHSA-chc6-3mhw-pc4r",
"modified": "2025-01-27T06:30:26Z",
"published": "2025-01-27T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43446"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2025-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CHCP-G9J5-3XXX
Vulnerability from github – Published: 2024-04-12 21:26 – Updated: 2024-04-15 19:41The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in the Backend or User plugin without having to go through authentication. This route is [[URL]]/_dusk/login/[[USER ID]]/[[MANAGER]] - where [[URL]] is the base URL of the site, [[USER ID]] is the ID of the user account and [[MANAGER]] is the authentication manager (either backend for Backend, or user for the User plugin).
If a configuration of a site using the Dusk plugin is set up in such a way that the Dusk plugin is available publicly and the test cases in Dusk are run with live data, this route may potentially be used to gain access to any user account in either the Backend or User plugin without authentication.
As indicated in the README, this plugin should only be used in development and should NOT be used in a production instance. It is specifically recommended that the plugin be installed as a development dependency only in Composer.
In order to remediate this issue, the special routes used above will now no longer be registered unless the APP_ENV environment variable is specifically set to dusk. Since Winter by default does not use this environment variable and it is not populated by default, it will only exist if Dusk's automatic configuration is used (which won't exhibit this vulnerability) or if a developer manually specifies it in their configuration.
The automatic configuration performed by the Dusk plugin has also been hardened by default to use sane defaults and not allow external environment variables to leak into this configuration.
Impact
Low. This will only affect users in which the Winter CMS installation meets ALL the following criteria:
- The Dusk plugin is installed in the Winter CMS instance.
- The application is in production mode (ie. the
debugconfig value is set totrueinconfig/app.php). - The Dusk plugin's automatic configuration has been overridden, either by providing a custom
.env.duskfile or by providing custom configuration in theconfig/duskfolder, or by providing configuration environment variables externally. - The environment has been configured to use production data in the database for testing, and not the temporary SQLite database that Dusk uses by default.
- The application is connectable via the web.
Patches
Issue has been fixed in v2.1.0.
For more information
If you have any questions or comments about this advisory:
- Email us at hello@wintercms.com
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "winter/wn-dusk-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32003"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-12T21:26:01Z",
"nvd_published_at": "2024-04-12T21:15:11Z",
"severity": "HIGH"
},
"details": "The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in the Backend or User plugin without having to go through authentication. This route is `[[URL]]/_dusk/login/[[USER ID]]/[[MANAGER]]` - where `[[URL]]` is the base URL of the site, `[[USER ID]]` is the ID of the user account and `[[MANAGER]]` is the authentication manager (either `backend` for Backend, or `user` for the User plugin).\n\nIf a configuration of a site using the Dusk plugin is set up in such a way that the Dusk plugin is available publicly and the test cases in Dusk are run with live data, this route may potentially be used to gain access to any user account in either the Backend or User plugin without authentication.\n\nAs indicated in the [README](https://github.com/wintercms/wn-dusk-plugin/blob/main/README.md), this plugin should only be used in development and should *NOT* be used in a production instance. It is specifically recommended that the plugin be installed as a development dependency only in Composer.\n\nIn order to remediate this issue, the special routes used above will now no longer be registered unless the `APP_ENV` environment variable is specifically set to `dusk`. Since Winter by default does not use this environment variable and it is not populated by default, it will only exist if Dusk\u0027s automatic configuration is used (which won\u0027t exhibit this vulnerability) or if a developer manually specifies it in their configuration.\n\nThe automatic configuration performed by the Dusk plugin has also been hardened by default to use sane defaults and not allow external environment variables to leak into this configuration.\n\n### Impact\n\nLow. This will only affect users in which the Winter CMS installation meets ALL the following criteria:\n\n- The Dusk plugin is installed in the Winter CMS instance.\n- The application is in production mode (ie. the `debug` config value is set to `true` in `config/app.php`).\n- The Dusk plugin\u0027s automatic configuration has been overridden, either by providing a custom `.env.dusk` file or by providing custom configuration in the `config/dusk` folder, or by providing configuration environment variables externally.\n- The environment has been configured to use production data in the database for testing, and not the temporary SQLite database that Dusk uses by default.\n- The application is connectable via the web.\n\n### Patches\n\nIssue has been fixed in v2.1.0.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)",
"id": "GHSA-chcp-g9j5-3xxx",
"modified": "2024-04-15T19:41:59Z",
"published": "2024-04-12T21:26:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wintercms/wn-dusk-plugin/security/advisories/GHSA-chcp-g9j5-3xxx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32003"
},
{
"type": "PACKAGE",
"url": "https://github.com/wintercms/wn-dusk-plugin"
},
{
"type": "WEB",
"url": "https://github.com/wintercms/wn-dusk-plugin/blob/main/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Dusk plugin may allow unfettered user authentication in misconfigured installs"
}
GHSA-CHCX-VRJH-R97H
Vulnerability from github – Published: 2025-11-25 06:33 – Updated: 2025-11-25 06:33The EduKart Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'edukart_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
{
"affected": [],
"aliases": [
"CVE-2025-13559"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-25T05:16:10Z",
"severity": "CRITICAL"
},
"details": "The EduKart Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the \u0027edukart_pro_register_user_front_end\u0027 function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the \u0027administrator\u0027 role during registration and gain administrator access to the site.",
"id": "GHSA-chcx-vrjh-r97h",
"modified": "2025-11-25T06:33:11Z",
"published": "2025-11-25T06:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13559"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/edit-edukart-online-courses-education-lms-theme/52094805"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a5be68-8073-48b0-a536-bb3a05e83dda?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CHGW-36XV-47CW
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2024-09-27 21:22An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"16.0.0"
]
}
],
"aliases": [
"CVE-2020-12689"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-29T10:23:44Z",
"nvd_published_at": "2020-05-07T00:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.",
"id": "GHSA-chgw-36xv-47cw",
"modified": "2024-09-27T21:22:35Z",
"published": "2022-05-24T17:17:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12689"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/37e9907a176dad6843819b1bec4946c3aecc4548"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1872735"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-53.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2020-004.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4480-1"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2020/05/06/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/05/07/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context "
}
GHSA-CHMC-GG3M-2H26
Vulnerability from github – Published: 2022-05-24 17:13 – Updated: 2022-05-24 17:13A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, watchOS 6.2. A malicious application may be able to elevate privileges.
{
"affected": [],
"aliases": [
"CVE-2020-3913"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-01T18:15:00Z",
"severity": "MODERATE"
},
"details": "A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, watchOS 6.2. A malicious application may be able to elevate privileges.",
"id": "GHSA-chmc-gg3m-2h26",
"modified": "2022-05-24T17:13:10Z",
"published": "2022-05-24T17:13:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3913"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211100"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211102"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211103"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CHP6-C7F5-H9W9
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2025-10-22 00:32Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291.
{
"affected": [],
"aliases": [
"CVE-2021-42278"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-10T01:19:00Z",
"severity": "HIGH"
},
"details": "Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291.",
"id": "GHSA-chp6-c7f5-h9w9",
"modified": "2025-10-22T00:32:26Z",
"published": "2022-05-24T19:20:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42278"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42278"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42278"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CHXV-752J-4VJ4
Vulnerability from github – Published: 2024-07-03 18:48 – Updated: 2024-08-01 15:31Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe
{
"affected": [],
"aliases": [
"CVE-2024-37726"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-03T14:15:06Z",
"severity": "MODERATE"
},
"details": "Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe",
"id": "GHSA-chxv-752j-4vj4",
"modified": "2024-08-01T15:31:52Z",
"published": "2024-07-03T18:48:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37726"
},
{
"type": "WEB",
"url": "https://github.com/carsonchan12345/CVE-2024-37726-MSI-Center-Local-Privilege-Escalation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-CJ35-HHR2-7QGH
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-05-24 17:22An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks.
{
"affected": [],
"aliases": [
"CVE-2020-15529"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-05T01:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks.",
"id": "GHSA-cj35-hhr2-7qgh",
"modified": "2022-05-24T17:22:24Z",
"published": "2022-05-24T17:22:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15529"
},
{
"type": "WEB",
"url": "http://daniels-it-blog.blogspot.com/2020/07/gog-galaxy-escalation-of-privileges.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CJ39-J7P3-G95W
Vulnerability from github – Published: 2023-02-08 21:30 – Updated: 2023-02-18 21:30IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.
{
"affected": [],
"aliases": [
"CVE-2022-42438"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-08T19:15:00Z",
"severity": "HIGH"
},
"details": "IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.",
"id": "GHSA-cj39-j7p3-g95w",
"modified": "2023-02-18T21:30:17Z",
"published": "2023-02-08T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42438"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/238210"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6909427"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CJ6W-FVQV-86XP
Vulnerability from github – Published: 2026-06-02 00:31 – Updated: 2026-06-02 00:31In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2026-28586"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-01T22:16:25Z",
"severity": "LOW"
},
"details": "In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-cj6w-fvqv-86xp",
"modified": "2026-06-02T00:31:57Z",
"published": "2026-06-02T00:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28586"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/2026/2026-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.