CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Consequences

• Access Control: Gain Privileges or Assume Identity

How to prevent it

• Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
• Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
• Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Recent advisories

• GHSA-7hp6-4w63-5g45 — LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
• GO-2026-6791 — containerd CRI plugin: Checkpoint restore bypasses destination security context
• GHSA-pjr3-86v4-5p7w — Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
• GHSA-v3p6-34mc-hj7v — Vikunja: Scoped API token can mint unrestricted OAuth session credentials
• GHSA-4pvx-fwjj-8gpc — Ghost: Editors Could Promote Staff Users to Their Own Role
• CVE-2026-102490 — Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
• GHSA-9qh4-3jw8-366w — Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
• GHSA-3w57-8xmc-8v26 — AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
• GHSA-6rh5-qq4q-97xh — vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
• GHSA-8686-vhfx-7r3j — vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
• GHSA-2724-6cpj-gf3v — Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
• CVE-2026-84869 — A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host…
• GHSA-g29h-pfmp-qp9r — CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
• GHSA-xhfv-7758-r9hx — Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
• GHSA-j9fc-w3mr-x6mv — Budibase: Privilege escalation via public role assignment API missing app-level authorization

All advisories for CWE-269