CWE-283: Unverified Ownership
Base
The product does not properly verify that a critical resource is owned by the proper entity.
Consequences
- Access Control: Gain Privileges or Assume Identity
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Recent advisories
- GHSA-9c4x-gm8v-wgc4 — filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
- GHSA-mqq6-cqcx-38vg — Open WebUI's Model Import Overwrites Any Model Without Ownership Check
- GHSA-jfv4-h8mc-jcp8 — OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup
- GO-2026-4364 — Gitea does not properly validate repository ownership when linking attachments to releases
- GHSA-438m-6mhw-hq5w — Mautic vulnerable to secret data extraction via elfinder
- GHSA-6frx-j292-c844 — TYPO3 Allows Privilege Escalation to System Maintainer
- GHSA-j9wf-vvm6-4r9w — Unverified Ownership in Kubernetes
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor