CWE-280
AllowedImproper Handling of Insufficient Permissions or Privileges
Abstraction: Base · Status: Draft
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
293 vulnerabilities reference this CWE, most recent first.
GHSA-WC73-QPRF-6FV8
Vulnerability from github – Published: 2023-11-15 00:31 – Updated: 2024-08-29 21:31Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2023-43591"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-15T00:15:09Z",
"severity": "HIGH"
},
"details": "Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.\n",
"id": "GHSA-wc73-qprf-6fv8",
"modified": "2024-08-29T21:31:00Z",
"published": "2023-11-15T00:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43591"
},
{
"type": "WEB",
"url": "https://explore.zoom.us/en/trust/security/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJG5-FW3X-2X8V
Vulnerability from github – Published: 2026-05-04 09:31 – Updated: 2026-05-04 15:31In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10708513; Issue ID: MSV-6281.
{
"affected": [],
"aliases": [
"CVE-2026-20448"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-04T07:15:59Z",
"severity": "MODERATE"
},
"details": "In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10708513; Issue ID: MSV-6281.",
"id": "GHSA-wjg5-fw3x-2x8v",
"modified": "2026-05-04T15:31:13Z",
"published": "2026-05-04T09:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20448"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/May-2026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WM4W-7H2Q-3PF7
Vulnerability from github – Published: 2024-04-11 20:17 – Updated: 2024-04-15 19:42Impact
The matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don't have access to. As a precondition to the attack, the malicious user needs to know the event ID of the message they want to leak, as well as to be joined to both the Matrix room and the IRC channel it is bridged to.
The message reply containing the leaked message content is visible to IRC channel members when this happens.
Patches
matrix-appservice-irc 2.0.0 checks whether the user has permission to view an event before constructing a reply. Administrators should upgrade to this version.
Workarounds
It's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message. See these lines in the configuration file.
References
https://github.com/matrix-org/matrix-appservice-irc/pull/1799
For more information
If you have any questions or comments about this advisory, please email us at security at matrix.org.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "matrix-appservice-irc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32000"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-11T20:17:49Z",
"nvd_published_at": "2024-04-12T20:15:53Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThe matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don\u0027t have access to. As a precondition to the attack, the malicious user needs to know the event ID of the message they want to leak, as well as to be joined to both the Matrix room and the IRC channel it is bridged to.\n\nThe message reply containing the leaked message content is visible to IRC channel members when this happens.\n\n### Patches\n\nmatrix-appservice-irc 2.0.0 checks whether the user has permission to view an event before constructing a reply. Administrators should upgrade to this version.\n\n### Workarounds\n\nIt\u0027s possible to limit the amount of information leaked by setting a reply template that doesn\u0027t contain the original message. See [these lines](https://github.com/matrix-org/matrix-appservice-irc/blob/d5d67d1d3ea3f0f6962a0af2cc57b56af3ad2129/config.sample.yaml#L601-L604) in the configuration file.\n\n### References\nhttps://github.com/matrix-org/matrix-appservice-irc/pull/1799\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:security@matrix.org).",
"id": "GHSA-wm4w-7h2q-3pf7",
"modified": "2024-04-15T19:42:06Z",
"published": "2024-04-11T20:17:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-wm4w-7h2q-3pf7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32000"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/matrix-appservice-irc/pull/1799"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/matrix-appservice-irc/commit/4af7d3009f10b1f2fb810784c1e491d9d3bee82b"
},
{
"type": "PACKAGE",
"url": "https://github.com/matrix-org/matrix-appservice-irc"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/matrix-appservice-irc/blob/d5d67d1d3ea3f0f6962a0af2cc57b56af3ad2129/config.sample.yaml#L601-L604"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Matrix IRC Bridge truncated content of messages can be leaked"
}
GHSA-WQ87-X384-6WM9
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-15 00:31This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.
{
"affected": [],
"aliases": [
"CVE-2026-43786"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:11Z",
"severity": "HIGH"
},
"details": "This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.",
"id": "GHSA-wq87-x384-6wm9",
"modified": "2026-09-15T00:31:12Z",
"published": "2026-09-14T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43786"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149035"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149042"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X394-245G-P4P8
Vulnerability from github – Published: 2026-03-02 21:31 – Updated: 2026-03-06 06:30In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2026-0047"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T19:16:31Z",
"severity": "HIGH"
},
"details": "In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-x394-245g-p4p8",
"modified": "2026-03-06T06:30:32Z",
"published": "2026-03-02T21:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0047"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2026-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X4Q2-5WX6-98M5
Vulnerability from github – Published: 2025-12-18 12:30 – Updated: 2025-12-23 18:30Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2025-64997"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-18T10:16:11Z",
"severity": "MODERATE"
},
"details": "Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.",
"id": "GHSA-x4q2-5wx6-98m5",
"modified": "2025-12-23T18:30:24Z",
"published": "2025-12-18T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64997"
},
{
"type": "WEB",
"url": "https://checkmk.com/werk/18681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X5CX-W6P2-MXF2
Vulnerability from github – Published: 2026-08-20 18:45 – Updated: 2026-08-20 18:45Impact
A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.
Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds
N/A
Acknowledgements
Many thanks to tinyb0y for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels
- Email us at security@wagtail.org (view our security policy for more information).
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wagtail"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "wagtail"
},
"ranges": [
{
"events": [
{
"introduced": "7.1"
},
{
"fixed": "7.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "wagtail"
},
"ranges": [
{
"events": [
{
"introduced": "7.4"
},
{
"fixed": "7.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "wagtail"
},
"ranges": [
{
"events": [
{
"introduced": "8.0rc1"
},
{
"fixed": "8.0rc2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.0rc1"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-20T18:45:23Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nA CMS user with \"add\" permission over a snippet model, but not \"change\" or \"view\" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail\u0027s [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
"id": "GHSA-x5cx-w6p2-mxf2",
"modified": "2026-08-20T18:45:23Z",
"published": "2026-08-20T18:45:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2"
},
{
"type": "PACKAGE",
"url": "https://github.com/wagtail/wagtail"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Wagtail: Improper permission handling when copying snippets"
}
GHSA-X5PH-C3X5-4WMG
Vulnerability from github – Published: 2025-08-09 00:30 – Updated: 2025-08-11 21:31Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE).
{
"affected": [],
"aliases": [
"CVE-2025-6573"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-09T00:15:26Z",
"severity": "CRITICAL"
},
"details": "Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE).",
"id": "GHSA-x5ph-c3x5-4wmg",
"modified": "2025-08-11T21:31:34Z",
"published": "2025-08-09T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6573"
},
{
"type": "WEB",
"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XG2Q-7399-F2R3
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-09-16 15:30In the Linux kernel, the following vulnerability has been resolved:
selinux: fix overlayfs mmap() and mprotect() access checks
The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the mounter's credentials are sufficient to access the lower level file (the "backing" file). Unfortunately, the current code does not properly enforce these access controls for both mmap() and mprotect() operations on overlayfs filesystems.
This patch makes use of the newly created security_mmap_backing_file() LSM hook to provide the missing backing file enforcement for mmap() operations, and leverages the backing file API and new LSM blob to provide the necessary information to properly enforce the mprotect() access controls.
{
"affected": [],
"aliases": [
"CVE-2026-46054"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:25Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: fix overlayfs mmap() and mprotect() access checks\n\nThe existing SELinux security model for overlayfs is to allow access if\nthe current task is able to access the top level file (the \"user\" file)\nand the mounter\u0027s credentials are sufficient to access the lower\nlevel file (the \"backing\" file). Unfortunately, the current code does\nnot properly enforce these access controls for both mmap() and mprotect()\noperations on overlayfs filesystems.\n\nThis patch makes use of the newly created security_mmap_backing_file()\nLSM hook to provide the missing backing file enforcement for mmap()\noperations, and leverages the backing file API and new LSM blob to\nprovide the necessary information to properly enforce the mprotect()\naccess controls.",
"id": "GHSA-xg2q-7399-f2r3",
"modified": "2026-09-16T15:30:36Z",
"published": "2026-05-27T15:33:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46054"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46054.json"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d844702198395d3f80222777030f69db6be6b709"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bc6c380c1159de52a252ed11f19a42c47f60a735"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8bacd09f12c27710228562e4d13163e58c5f4a45"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482025"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-46054"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:67723"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:67721"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59473"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59091"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:52764"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:52667"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:52649"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:51746"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30848"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27812"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:27811"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25191"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XG3G-RJ7R-VM56
Vulnerability from github – Published: 2025-01-07 03:31 – Updated: 2025-01-07 03:31Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.
{
"affected": [],
"aliases": [
"CVE-2025-22395"
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T03:15:06Z",
"severity": "HIGH"
},
"details": "Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.",
"id": "GHSA-xg3g-rj7r-vm56",
"modified": "2025-01-07T03:31:38Z",
"published": "2025-01-07T03:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22395"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000269079/dsa-2025-034-security-update-for-dell-update-package-dup-framework-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation
Always check to see if you have successfully accessed a resource or system functionality, and use proper error handling if it is unsuccessful. Do this even when you are operating in a highly privileged mode, because errors or environmental conditions might still cause a failure. For example, environments with highly granular permissions/privilege models, such as Windows or Linux capabilities, can cause unexpected failures.
No CAPEC attack patterns related to this CWE.