# CWE-280.

Every Advisory and CVE whose sources give the weakness CWE-280, newest first.

## Records, newest first

- [In Modem, there is a possible escalation of privilege due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-20599.md)
  `CVE-2026-20599` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.7 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-280
- [In Modem, there is a possible permission bypass due to a permissions bypass.](https://agentprime.io/advisories/CVE-2026-20577.md)
  `CVE-2026-20577` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 4.4 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-280
- [Privilege escalation via request replaying in Lobster_pro](https://agentprime.io/advisories/CVE-2026-3322.md)
  `CVE-2026-3322` · CVE record: Lobster DATA GmbH Lobster_pro · CVSS 5.6 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-280
- [Gitea private reusable workflow disclosure to fork runs](https://agentprime.io/advisories/CVE-2026-63792.md)
  `CVE-2026-63792` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-280
- [Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.](https://agentprime.io/advisories/CVE-2026-21121.md)
  `CVE-2026-21121` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-280
- [An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint](https://agentprime.io/advisories/CVE-2026-79403.md)
  `CVE-2026-79403` · CVE record · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-280
- [Zammad: Titles of knowledge base answers will be shown across all categories via the global search](https://agentprime.io/advisories/CVE-2026-56729.md)
  `CVE-2026-56729` · CVE record: zammad zammad · CVSS 2.1 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-280
- [WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions](https://agentprime.io/advisories/CVE-2026-96872.md)
  `CVE-2026-96872` · CVE record: The Wikimedia Foundation Mediawiki - WikiLambda Extension · CVSS 2.9 Low · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-280
- [Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization](https://agentprime.io/advisories/CVE-2026-90462.md)
  `CVE-2026-90462` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-280
- [Dell SmartFabric Manager: Dell SmartFabric Manager, versions prior to 2.2.1…](https://agentprime.io/advisories/CVE-2026-54471.md)
  `CVE-2026-54471` · CVE record: Dell SmartFabric Manager · CVSS 3.5 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-280
- [Secomea GateManager: Improper handling of insufficient permissions or privileges vulnerability in Secomea…](https://agentprime.io/advisories/CVE-2026-1759.md)
  `CVE-2026-1759` · CVE record: Secomea GateManager · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-280
- [This issue was addressed with additional entitlement checks.](https://agentprime.io/advisories/CVE-2026-84631.md)
  `CVE-2026-84631` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-280
- [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2026-64701.md)
  `CVE-2026-64701` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-280
- [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2026-86917.md)
  `CVE-2026-86917` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-280
- [This issue was addressed with additional entitlement checks.](https://agentprime.io/advisories/CVE-2026-43786.md)
  `CVE-2026-43786` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-280
- [Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.](https://agentprime.io/advisories/CVE-2026-21099.md)
  `CVE-2026-21099` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-280
- [Windows Enterprise App Management Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69907.md)
  `CVE-2026-69907` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-280
- [Local privilege escalation](https://agentprime.io/advisories/CVE-2026-59567.md)
  `CVE-2026-59567` · CVE record: Zscaler Client Connector · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-280
- [Wagtail: Improper restriction handling on Page translation API endpoint](https://agentprime.io/advisories/GHSA-jm5p-837g-rv8g.md)
  `GHSA-jm5p-837g-rv8g` · PyPI `wagtail`: affected `<7.0.9 || >=7.1rc1, <7.3.4 || >=7.4rc1, <7.4.3 || >=8.0rc1, <8.0rc2`, fixed in `7.0.9`, `7.3.4`, `7.4.3`, `8.0rc2` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Improper permission handling when copying snippets](https://agentprime.io/advisories/GHSA-x5cx-w6p2-mxf2.md)
  `GHSA-x5cx-w6p2-mxf2` · PyPI `wagtail`: affected `<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2`, fixed in `7.0.9`, `7.3.4`, `7.4.3`, `8.0rc2` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Improper restriction handling on descendant collections in Documents and Images API](https://agentprime.io/advisories/GHSA-c2xx-cjmh-9q8f.md)
  `GHSA-c2xx-cjmh-9q8f` · PyPI `wagtail`: affected `<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2`, fixed in `7.0.9`, `7.3.4`, `7.4.3`, `8.0rc2` · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Identification of documents by SHA1 hash](https://agentprime.io/advisories/GHSA-92hv-j533-69wc.md)
  `GHSA-92hv-j533-69wc` · PyPI `wagtail`: affected `<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2`, fixed in `7.0.9`, `7.3.4`, `7.4.3`, `8.0rc2` · CVSS 3.7 Low · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Improper restriction handling on Pages admin API](https://agentprime.io/advisories/GHSA-3vrh-m9w7-v94f.md)
  `GHSA-3vrh-m9w7-v94f`, `CVE-2026-55468`, `PYSEC-2026-3939` · PyPI `wagtail`: affected `<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2`, fixed in `7.0.9`, `7.3.4`, `7.4.3`, `8.0rc2` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Pages translations can be created without page permissions when using simple_translation](https://agentprime.io/advisories/GHSA-8634-mr4j-r72c.md)
  `GHSA-8634-mr4j-r72c`, `CVE-2026-54262`, `PYSEC-2026-615` · PyPI `wagtail`: affected `<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2`, fixed in `7.0.8`, `7.3.3`, `7.4.2` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Improper permission handling in image preview](https://agentprime.io/advisories/GHSA-r6p4-grq7-xm4m.md)
  `GHSA-r6p4-grq7-xm4m`, `CVE-2026-54261`, `PYSEC-2026-614` · PyPI `wagtail`: affected `<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2`, fixed in `7.0.8`, `7.3.3`, `7.4.2` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Wagtail: Improper restriction handling on Documents and Images chosen endpoints](https://agentprime.io/advisories/GHSA-h54r-xq46-qwqm.md)
  `GHSA-h54r-xq46-qwqm`, `CVE-2026-54259`, `PYSEC-2026-612` · PyPI `wagtail`: affected `<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2`, fixed in `7.0.8`, `7.3.3`, `7.4.2` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-280
- [Apache Allura: Missing permission checks IDOR](https://agentprime.io/advisories/CVE-2026-73239.md)
  `CVE-2026-73239` · CVE record: Apache Software Foundation Apache Allura · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control, CWE-280
- [Winter: Broken access control in \`Cms\Controllers\Index\` allows cross-template actions and unauthorized asset uploads](https://agentprime.io/advisories/GHSA-5c4f-9pq9-6c77.md)
  `GHSA-5c4f-9pq9-6c77`, `CVE-2026-32639`, `PKSA-m75m-ptnr-6hhr` · Packagist `winter/wn-cms-module`: affected `<1.2.13`, fixed in `1.2.13` · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-280, CWE-289
- [Velociraptor incorrect Org deletion permissions check](https://agentprime.io/advisories/CVE-2026-18860.md)
  `CVE-2026-18860` · CVE record: Rapid7 Velociraptor · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-280
- [Program Module Vulnerability](https://agentprime.io/advisories/CVE-2026-11804.md)
  `CVE-2026-11804` · CVE record: Tridium Niagara Framework and 1 more · CVSS 5.2 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-280
- [Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)](https://agentprime.io/advisories/GHSA-fj8v-hjwv-qm88.md)
  `GHSA-fj8v-hjwv-qm88`, `CVE-2026-58416`, `GO-2026-6052` · Go `gitea.dev`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, CWE-280
- [Apache Kylin: Improper authorization in job information retrieval](https://agentprime.io/advisories/CVE-2026-62393.md)
  `CVE-2026-62393` · CVE record: Apache Software Foundation Apache Kylin · CVSS 4.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-280
- [GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel](https://agentprime.io/advisories/CVE-2026-45196.md)
  `CVE-2026-45196` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-280
- [In Modem, there is a possible escalation of privilege due to a permissions bypass.](https://agentprime.io/advisories/CVE-2026-20463.md)
  `CVE-2026-20463` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.7 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-280
- [GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted](https://agentprime.io/advisories/CVE-2026-45195.md)
  `CVE-2026-45195` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-280
- [Apache Kvrocks: Improper permission for the APPLYBATCH command](https://agentprime.io/advisories/CVE-2026-41566.md)
  `CVE-2026-41566` · CVE record: Apache Software Foundation Apache Kvrocks · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-280
- [Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-40371.md)
  `CVE-2026-40371` · CVE record: Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-280
- [Data exposed without proper permission](https://agentprime.io/advisories/CVE-2026-11764.md)
  `CVE-2026-11764` · CVE record: pretix pretix · CVSS 3.6 Low · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-280
- [Privilege escalation in Yandex Database](https://agentprime.io/advisories/CVE-2026-10549.md)
  `CVE-2026-10549` · CVE record: Yandex Yandex Database · CVSS 5.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-280
- [Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege](https://agentprime.io/advisories/GHSA-33j3-g875-37rp.md)
  `GHSA-33j3-g875-37rp`, `CVE-2026-9792` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.6.3 || <=26.4.7`, fixed in `26.6.3` · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-280
- [selinux: fix overlayfs mmap() and mprotect() access checks](https://agentprime.io/advisories/CVE-2026-46054.md)
  `CVE-2026-46054` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 27 May 2026 · Tags: Broken access control, CWE-280
- [Samba: vfs_worm does not block directory modification](https://agentprime.io/advisories/CVE-2026-2340.md)
  `CVE-2026-2340` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-280
- [Wagtail has improper permission handling when copying pages](https://agentprime.io/advisories/GHSA-67rv-mg8q-5pf3.md)
  `GHSA-67rv-mg8q-5pf3`, `CVE-2026-44200`, `PYSEC-2026-149` · PyPI `wagtail`: affected `<7.0.7 || >=7.1, <7.3.2`, fixed in `7.0.7`, `7.3.2` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-280
- [Wagtail has improper restriction handling on Documents and Images API](https://agentprime.io/advisories/GHSA-p5gm-92h4-6pv6.md)
  `GHSA-p5gm-92h4-6pv6`, `CVE-2026-44201`, `PYSEC-2026-150` · PyPI `wagtail`: affected `<7.0.7 || >=7.1, <7.3.2`, fixed in `7.0.7`, `7.3.2` · CVSS 5.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-280
- [Wagtail has improper permission handling when deleting form submissions](https://agentprime.io/advisories/GHSA-pwm3-7fv4-g6xx.md)
  `GHSA-pwm3-7fv4-g6xx`, `CVE-2026-44199`, `PYSEC-2026-148` · PyPI `wagtail`: affected `<7.0.7 || >=7.1, <7.3.2`, fixed in `7.0.7`, `7.3.2` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-280
- [Wagtail has improper permission handling when viewing page history](https://agentprime.io/advisories/GHSA-c4mr-889m-vgf6.md)
  `GHSA-c4mr-889m-vgf6`, `CVE-2026-44198`, `PYSEC-2026-147` · PyPI `wagtail`: affected `<7.0.7 || >=7.1, <7.3.2`, fixed in `7.0.7`, `7.3.2` · CVSS 4.3 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-280
- [Wagtail has improper permission handling when comparing revisions](https://agentprime.io/advisories/GHSA-c6wj-9vcj-75pj.md)
  `GHSA-c6wj-9vcj-75pj`, `CVE-2026-44197`, `PYSEC-2026-146` · PyPI `wagtail`: affected `<7.0.7 || >=7.1, <7.3.2`, fixed in `7.0.7`, `7.3.2` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-280
- [Vulnerability on Cryptobox external sharing feature](https://agentprime.io/advisories/CVE-2026-6805.md)
  `CVE-2026-6805` · CVE record: Ercom Cryptobox · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-280
- [In geniezone, there is a possible escalation of privilege due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-20448.md)
  `CVE-2026-20448` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.7 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-280
- [GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)](https://agentprime.io/advisories/CVE-2026-21733.md)
  `CVE-2026-21733` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.3 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-20, CWE-280
- [Windows Installer Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-27910.md)
  `CVE-2026-27910` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-280
- [Insufficient permission validation on multiple REST API Quick Setup endpoints](https://agentprime.io/advisories/CVE-2026-24096.md)
  `CVE-2026-24096` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-280
- [Privilege escalation vulnerability in Operations Agent](https://agentprime.io/advisories/CVE-2026-2123.md)
  `CVE-2026-2123` · CVE record: OpenText Operations Agent · CVSS 8.6 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-280
- [Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure](https://agentprime.io/advisories/GHSA-q35r-vvhv-vx5h.md)
  `GHSA-q35r-vvhv-vx5h`, `CVE-2026-3190` · Maven `org.keycloak:keycloak-model-jpa` and 2 more: affected `<26.5.6`, fixed in `26.5.6` · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-280
- [GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled](https://agentprime.io/advisories/CVE-2026-21736.md)
  `CVE-2026-21736` · CVE record: Imagination Technologies Graphics DDK · CVSS 4.4 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-280
- [In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-0047.md)
  `CVE-2026-0047` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-280
- [RTU500 web interface: An unprivileged user can read user management information.](https://agentprime.io/advisories/CVE-2026-1772.md)
  `CVE-2026-1772` · CVE record: Hitachi Energy RTU500 series CMU firmware · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-280
- [Dell Update Package: Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00…](https://agentprime.io/advisories/CVE-2026-23857.md)
  `CVE-2026-23857` · CVE record: Dell Update Package · CVSS 8.2 High · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-280
- [Moodle authentication bypass vulnerability](https://agentprime.io/advisories/GHSA-j5jv-w5cw-j9ff.md)
  `GHSA-j5jv-w5cw-j9ff`, `BIT-moodle-2025-67848`, `CVE-2025-67848`, `PKSA-d2w7-632f-6wy9` · Packagist `moodle/moodle`: affected `<4.1.22 || >=4.4.0-beta, <4.4.12 || >=4.5.0-beta, <4.5.8 || >=5.0.0-beta, <5.0.4 || >=5.1.0-beta, <5.1.1`, fixed in `4.1.22`, `4.4.12`, `4.5.8`, `5.0.4`, `5.1.1` · CVSS 8.1 High · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-280
- [Windows Error Reporting Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-20817.md)
  `CVE-2026-20817` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-280

Older: <https://agentprime.io/advisories/tag/cwe-280.md?cursor=WyIyMDI2LTAxLTEzVDE3OjU2OjE0LjA5MTAwMFoiLCJDVkUtMjAyNi0yMDgxNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-280>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-280/>. Everything for agents: <https://agentprime.io/llms.txt>.