CWE-280 Improper Handling of Insufficient Permissions or Privileges
baseThe product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (198)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-29748US | high7.8OT critical | KEV | ||
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti… | ||||
| CVE-2024-24116US | critical9.8 | — | ||
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. | ||||
| CVE-2020-17533US | high8.1 | Exploit | ||
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user… | ||||
| CVE-2023-42931US | high7.8 | Exploit | ||
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin privileges without pro… | ||||
| CVE-2024-0015US | high7.8 | Exploit | ||
In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of p… | ||||
| CVE-2024-46874US | critical9.9 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device… | ||||
| CVE-2023-6267US | critical9.8 | — | ||
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized)… | ||||
| CVE-2026-24096US | high8.8 | — | ||
Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged… | ||||
| CVE-2025-58770US | high8.8 | — | ||
APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploitation of this vulner… | ||||
| CVE-2025-22256US | high8.8 | — | ||
A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 throu… | ||||
| CVE-2025-29826US | high8.8 | — | ||
Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2024-25108US | high8.8OT elevated | — | ||
Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functiona… | ||||
| CVE-2023-4047US | high8.8 | — | ||
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Fire… | ||||
| CVE-2023-32207US | high8.8 | — | ||
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR… | ||||
| CVE-2022-2193US | high8.8 | — | ||
Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via par… | ||||
| CVE-2019-6570US | high8.8OT elevated | — | ||
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may access URLs that requir… | ||||
| CVE-2020-29031US | high8.1 | — | ||
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or… | ||||
| CVE-2026-69907US | high7.8 | — | ||
Improper handling of insufficient permissions or privileges in Windows Enterprise App Management allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-2123US | high7.8 | — | ||
A security audit identified a privilege escalation
vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions
Operations Agent may run executables from spe… | ||||
| CVE-2025-45376US | high7.8 | — | ||
Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with local… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan