CWE-268 Privilege Chaining
baseTwo distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (29)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-49741US | high7.5 | Exploit | ||
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2019-3844US | high7.8 | Exploit | ||
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by… | ||||
| CVE-2018-11766US | high8.8 | — | ||
In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user. | ||||
| CVE-2023-0971US | high8.8OT elevated | — | ||
A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be reco… | ||||
| CVE-2023-0759US | high8.8 | — | ||
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. | ||||
| CVE-2024-1299US | high8.1 | — | ||
A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `mana… | ||||
| CVE-2025-9068US | high7.8 | — | ||
A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with v… | ||||
| CVE-2025-9067US | high7.8 | — | ||
A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and… | ||||
| CVE-2025-2297US | high7.8 | — | ||
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certai… | ||||
| CVE-2025-0889US | high7.8 | — | ||
Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain… | ||||
| CVE-2023-5839US | high7.8 | — | ||
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9. | ||||
| CVE-2025-36124US | high7.5 | — | ||
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configur… | ||||
| CVE-2023-28390US | medium6.8 | — | ||
Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 and earlier allows a network-adjacent attacker with administrat… | ||||
| CVE-2023-2250US | medium6.7 | — | ||
A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deploymen… | ||||
| CVE-2024-1250US | medium6.5 | — | ||
An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission,… | ||||
| CVE-2023-20194US | medium4.9 | — | ||
A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To explo… | ||||
| CVE-2022-1003US | medium4.9 | — | ||
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capa… | ||||
| CVE-2021-3932US | medium4.3 | — | ||
twill is vulnerable to Cross-Site Request Forgery (CSRF) | ||||
| CVE-2024-28085US | — | Exploit | ||
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape seque… | ||||
| CVE-2026-3888US | — | Exploit | ||
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automa… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan