Skip to content
Log inStart free trial

CWE-653: Improper Isolation or Compartmentalization

Class

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.

Consequences

  • Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism

How to prevent it

  • Architecture and Design: Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Recent advisories

  • GHSA-69qc-f5m6-889c — Ghost: Stored XSS via Embed Card Previews
  • GHSA-fcqc-726x-5wfc — vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
  • GHSA-62fc-8686-hfmq — Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
  • EEF-CVE-2026-65635 — Boruta dynamic client registration allows creation of over-privileged OAuth clients
  • GHSA-9vg3-4rfj-wgcm — vm2 has Sandbox Breakout Through Null Proto Exception
  • GHSA-vwrp-x96c-mhwq — vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
  • GHSA-47x8-96vw-5wg6 — vm2 Access to Host Object Enables Sandbox Escape
  • GHSA-ffh4-j6h5-pg66 — VM2 Has a WASM Sandbox Escape
  • GHSA-55hx-c926-fr95 — VM2 Has a Sandbox Escape Issue via SuppressedError
  • GHSA-v37h-5mfm-c47c — VM2 Has Sandbox Breakout Through Inspect Function
  • GHSA-xhjw-95fp-8vgq — Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
  • GHSA-xwr5-m59h-vwqr — Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
  • GHSA-rx66-hj7g-28h7 — Keycloak: Replay of action tokens via improper handling of single-use entries
  • GHSA-hj93-h7pg-fh6v — Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
  • CVE-2025-21590 — An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to…

All advisories for CWE-653

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor