# CWE-280.

Every Advisory and CVE whose sources give the weakness CWE-280, newest first.

## Records, newest first (an older page)

- [An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges](https://agentprime.io/advisories/CVE-2025-46066.md)
  `CVE-2025-46066` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-280
- [Insufficient permission validation when showing agent information](https://agentprime.io/advisories/CVE-2025-64997.md)
  `CVE-2025-64997` · CVE record: Checkmk GmbH Checkmk · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-280
- [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2025-43527.md)
  `CVE-2025-43527` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 12 Dec 2025 · Tags: CWE-280
- [TCG2 TPM RT Not Locked Issue](https://agentprime.io/advisories/CVE-2025-58770.md)
  `CVE-2025-58770` · CVE record: AMI AptioV · CVSS 7.2 High · Not analysed yet · Published 12 Dec 2025 · Tags: CWE-280
- [Insufficient permission validation on multiple REST API endpoints](https://agentprime.io/advisories/CVE-2025-58121.md)
  `CVE-2025-58121` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-280
- [Insufficient permission validation when configuring notification parameters](https://agentprime.io/advisories/CVE-2025-58122.md)
  `CVE-2025-58122` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-280
- [GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR](https://agentprime.io/advisories/CVE-2025-58410.md)
  `CVE-2025-58410` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.5 High · Not analysed yet · Published 17 Nov 2025 · Tags: CWE-280
- [FileRise insecure folder visibility via name-based mapping and incomplete ACL checks](https://agentprime.io/advisories/CVE-2025-62510.md)
  `CVE-2025-62510` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2025 · Tags: Broken access control, CWE-280
- [FileRise improper ownership/permission validation allowed cross-tenant file operations](https://agentprime.io/advisories/CVE-2025-62509.md)
  `CVE-2025-62509` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2025 · Tags: Broken access control, CWE-280
- [Mastadon streaming server allows OAuth clients without the \`read\` scope to subscribe to public channels](https://agentprime.io/advisories/CVE-2025-62176.md)
  `CVE-2025-62176` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-280
- [Dell Repository Manager (DRM): Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8…](https://agentprime.io/advisories/CVE-2025-45376.md)
  `CVE-2025-45376` · CVE record: Dell Dell Repository Manager (DRM) · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2025 · Tags: CWE-280
- [Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands](https://agentprime.io/advisories/GHSA-2hmj-97jw-28jh.md)
  `GHSA-2hmj-97jw-28jh`, `BIT-zookeeper-2025-58457`, `CVE-2025-58457` · Maven `org.apache.zookeeper:zookeeper`: affected `>=3.9.0, <3.9.4`, fixed in `3.9.4` · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: CWE-280
- [Tuleap backlog item representations do not verify the permissions of the child trackers](https://agentprime.io/advisories/CVE-2025-59040.md)
  `CVE-2025-59040` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2025 · Tags: CWE-280
- [Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-50170.md)
  `CVE-2025-50170` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-280
- [GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite](https://agentprime.io/advisories/CVE-2025-6573.md)
  `CVE-2025-6573` · CVE record: Imagination Technologies Graphics DDK · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: CWE-280
- [GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation](https://agentprime.io/advisories/CVE-2025-8109.md)
  `CVE-2025-8109` · CVE record: Imagination Technologies Graphics DDK · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2025 · Tags: CWE-280
- [Microsoft Teams Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-49731.md)
  `CVE-2025-49731` · CVE record: Microsoft Microsoft Teams for Android and 2 more · CVSS 3.1 Low · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-280
- [Improper File Access in Infinera G42](https://agentprime.io/advisories/CVE-2025-27025.md)
  `CVE-2025-27025` · CVE record: Infinera G42 · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2025 · Tags: CWE-280
- [Improper File Access in Infinera G42](https://agentprime.io/advisories/CVE-2025-27024.md)
  `CVE-2025-27024` · CVE record: Infinera G42 · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2025 · Tags: CWE-280
- [GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs](https://agentprime.io/advisories/CVE-2025-46708.md)
  `CVE-2025-46708` · CVE record: Imagination Technologies Graphics DDK · CVSS 4.3 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: CWE-280
- [Fortinet FortiPAM: A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0…](https://agentprime.io/advisories/CVE-2025-22256.md)
  `CVE-2025-22256` · CVE record: Fortinet FortiPAM and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-280
- [GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory](https://agentprime.io/advisories/CVE-2025-25179.md)
  `CVE-2025-25179` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-280
- [Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil](https://agentprime.io/advisories/GHSA-rpg2-jvhp-h354.md)
  `GHSA-rpg2-jvhp-h354`, `CVE-2025-3931`, `GO-2025-3688` · Go `github.com/redhatinsights/yggdrasil`: affected `*`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 15 May 2025 · Tags: CWE-280
- [Microsoft Dataverse Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-29826.md)
  `CVE-2025-29826` · CVE record: Microsoft Microsoft Dataverse · CVSS 7.3 High · Not analysed yet · Published 13 May 2025 · Tags: CWE-280
- [The issue was addressed with additional permissions checks.](https://agentprime.io/advisories/CVE-2025-30453.md)
  `CVE-2025-30453` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 12 May 2025 · Tags: CWE-280
- [Improper Handling of Insufficient Permissions](https://agentprime.io/advisories/CVE-2025-46740.md)
  `CVE-2025-46740` · CVE record: Schweitzer Engineering Laboratories SEL Blueframe OS · CVSS 7.5 High · Not analysed yet · Published 12 May 2025 · Tags: CWE-280
- [Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2025-46584.md)
  `CVE-2025-46584` · CVE record: Huawei HarmonyOS · CVSS 7.8 High · Not analysed yet · Published 6 May 2025 · Tags: CWE-280
- [Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2025-31173.md)
  `CVE-2025-31173` · CVE record: Huawei HarmonyOS · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2025 · Tags: CWE-280
- [Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2025-31172.md)
  `CVE-2025-31172` · CVE record: Huawei HarmonyOS · CVSS 7.8 High · Not analysed yet · Published 7 Apr 2025 · Tags: CWE-280
- [GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)](https://agentprime.io/advisories/CVE-2025-0468.md)
  `CVE-2025-0468` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.1 High · Not analysed yet · Published 4 Apr 2025 · Tags: CWE-280
- [Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources](https://agentprime.io/advisories/CVE-2024-55604.md)
  `CVE-2024-55604` · CVE record: appsmithorg appsmith · CVSS 4.8 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-280
- [Improper Handling of Insufficient Permissions or Privileges in B&R APROL](https://agentprime.io/advisories/CVE-2024-8315.md)
  `CVE-2024-8315` · CVE record: B&R Industrial Automation B&R APROL · CVSS 6.8 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-280
- [GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object](https://agentprime.io/advisories/CVE-2025-0478.md)
  `CVE-2025-0478` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2025 · Tags: CWE-280
- [IBM InfoSphere Server Information command execution](https://agentprime.io/advisories/CVE-2024-51459.md)
  `CVE-2024-51459` · CVE record: IBM InfoSphere Information Server · CVSS 8.4 High · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-280
- [Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2025-27521.md)
  `CVE-2025-27521` · CVE record: Huawei HarmonyOS · CVSS 6.8 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-280
- [In Bluetooth Stack SW, there is a possible information disclosure due to a missing permission check.](https://agentprime.io/advisories/CVE-2025-20649.md)
  `CVE-2025-20649` · CVE record: MediaTek, Inc. MT6880, MT6890, MT6980, MT6990, MT7663, MT7902, MT7925, MT7927, MT7961 · CVSS 6.5 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-280
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges](https://agentprime.io/advisories/CVE-2024-6697.md)
  `CVE-2024-6697` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-280
- [Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap](https://agentprime.io/advisories/CVE-2025-22129.md)
  `CVE-2025-22129` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-280
- [Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap](https://agentprime.io/advisories/CVE-2025-24029.md)
  `CVE-2025-24029` · CVE record: Enalean tuleap · CVSS 5.3 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-280
- [An attacker who successfully exploited these vulnerabilities could cause enable command execution.](https://agentprime.io/advisories/CVE-2024-12430.md)
  `CVE-2024-12430` · CVE record: ABB AC500 V3 · CVSS 7.3 High · Not analysed yet · Published 7 Jan 2025 · Tags: CWE-280
- [Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability.](https://agentprime.io/advisories/CVE-2025-22395.md)
  `CVE-2025-22395` · CVE record: Dell Dell Update Package (DUP) Framework · CVSS 8.2 High · Not analysed yet · Published 7 Jan 2025 · Tags: CWE-280
- [GPU DDK - Security: Exploitable PVRSRVBridgePhysmemWrapExtMem may lead to overwrite read-only file/memory (e.g. libc.so)](https://agentprime.io/advisories/CVE-2024-43705.md)
  `CVE-2024-43705` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 28 Dec 2024 · Tags: CWE-280
- [HCL BigFix Inventory is affected by an access control vulnerability](https://agentprime.io/advisories/CVE-2024-42194.md)
  `CVE-2024-42194` · CVE record: HCL Software BigFix Inventory · CVSS 3.1 Low · Not analysed yet · Published 17 Dec 2024 · Tags: CWE-280
- [Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges](https://agentprime.io/advisories/CVE-2024-46874.md)
  `CVE-2024-46874` · CVE record: Ruijie Reyee OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-280
- [GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages](https://agentprime.io/advisories/CVE-2024-43702.md)
  `CVE-2024-43702` · CVE record: Imagination Technologies Graphics DDK · CVSS 8.1 High · Not analysed yet · Published 30 Nov 2024 · Tags: CWE-280
- [Multiple missing permission checks](https://agentprime.io/advisories/CVE-2024-4692.md)
  `CVE-2024-4692` · CVE record: OpenText OpenText Application Automation Tools · CVSS 1.8 Low · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-280
- [Multiple missing permission checks](https://agentprime.io/advisories/CVE-2024-4211.md)
  `CVE-2024-4211` · CVE record: OpenText OpenText Application Automation Tools · CVSS 1.8 Low · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-280
- [Tuleap lists trackers in the quick add actions of the backlog without any permissions check](https://agentprime.io/advisories/CVE-2024-47767.md)
  `CVE-2024-47767` · CVE record: Enalean tuleap · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-280
- [Permissions are incorrectly verified for project administrators in the cross tracker search widget](https://agentprime.io/advisories/CVE-2024-47766.md)
  `CVE-2024-47766` · CVE record: Enalean tuleap · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-280
- [Tuleap does not properly check permissions for email notifications in trackers](https://agentprime.io/advisories/CVE-2024-46988.md)
  `CVE-2024-46988` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: CWE-280
- [An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.](https://agentprime.io/advisories/CVE-2024-24116.md)
  `CVE-2024-24116` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 2 Oct 2024 · Tags: CWE-280
- [PLANET Technology switch devices - SSH server DoS attack](https://agentprime.io/advisories/CVE-2024-8451.md)
  `CVE-2024-8451` · CVE record: PLANET Technology GS-4210-24PL4C hardware 2.0 and 1 more · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2024 · Tags: Denial of service, CWE-280
- [usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges in github.com/usememos/memos](https://agentprime.io/advisories/GHSA-6whj-8g9g-5jvx.md)
  `GHSA-6whj-8g9g-5jvx`, `CVE-2022-4863`, `GO-2023-1270` · Go `github.com/usememos/memos`: affected `<0.9.1`, fixed in `0.9.1` · CVSS 8.4 High · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-280
- [BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload](https://agentprime.io/advisories/CVE-2024-6660.md)
  `CVE-2024-6660` · CVE record: reputeinfosystems Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress · CVSS 8.8 High · Not analysed yet · Published 17 Jul 2024 · Tags: CWE-280
- [Webmin: Improper handling of insufficient permissions or privileges vulnerability exists in…](https://agentprime.io/advisories/CVE-2024-36451.md)
  `CVE-2024-36451` · CVE record: Webmin Webmin · CVSS 8.8 High · Not analysed yet · Published 10 Jul 2024 · Tags: CWE-280
- [Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to](https://agentprime.io/advisories/GHSA-w9mh-5x8j-9754.md)
  `GHSA-w9mh-5x8j-9754`, `CVE-2024-39691` · npm `matrix-appservice-irc`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 4.3 Medium · Not analysed yet · Published 5 Jul 2024 · Tags: CWE-280, CWE-755
- [Improper Handling of Insufficient Permissions or Privileges in Conduit](https://agentprime.io/advisories/CVE-2024-6302.md)
  `CVE-2024-6302` · CVE record: The Conduit Contributors Conduit · CVSS 8.1 High · Not analysed yet · Published 25 Jun 2024 · Tags: CWE-280
- [Improper permission settings in com.transsion.carlcare](https://agentprime.io/advisories/CVE-2024-5163.md)
  `CVE-2024-5163` · CVE record: TECNO com.transsion.carlcare · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2024 · Tags: Broken access control, CWE-280
- [Salon booking system <= 9.9 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-4468.md)
  `CVE-2024-4468` · CVE record: wordpresschef Salon Booking System – Free Version · CVSS 4.3 Medium · Not analysed yet · Published 8 Jun 2024 · Tags: CWE-280
- [Improper Handling of Insufficient Permissions in \`wagtail.contrib.settings\`](https://agentprime.io/advisories/GHSA-xxfm-vmcf-g33f.md)
  `GHSA-xxfm-vmcf-g33f`, `CVE-2024-35228`, `PYSEC-2026-2032` · PyPI `wagtail`: affected `>=6.0.0, <6.0.5 || >=6.1.0, <6.1.2`, fixed in `6.0.5`, `6.1.2` · CVSS 5.5 Medium · Not analysed yet · Published 2 Jun 2024 · Tags: CWE-280

Newest: <https://agentprime.io/advisories/tag/cwe-280.md>
Older: <https://agentprime.io/advisories/tag/cwe-280.md?cursor=WyIyMDI0LTA2LTAyVDIyOjI4OjI4LjAwMDAwMFoiLCJHSFNBLXh4Zm0tdm1jZi1nMzNmIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-280&cursor=WyIyMDI2LTAxLTEzVDE3OjU2OjE0LjA5MTAwMFoiLCJDVkUtMjAyNi0yMDgxNyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-280/?cursor=WyIyMDI2LTAxLTEzVDE3OjU2OjE0LjA5MTAwMFoiLCJDVkUtMjAyNi0yMDgxNyJd>. Everything for agents: <https://agentprime.io/llms.txt>.