CWE-280.

In Modem, there is a possible escalation of privilege due to a missing permission check.

• MediaTek, Inc. MediaTek chipset
• CWE-280

In Modem, there is a possible permission bypass due to a permissions bypass.

• MediaTek, Inc. MediaTek chipset
• CWE-280

Privilege escalation via request replaying in Lobster_pro

• Lobster DATA GmbH Lobster_pro
• CWE-280

Gitea private reusable workflow disclosure to fork runs

• Gitea
• CWE-280

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

• Samsung Mobile Devices
• CWE-280

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint

• CWE-280

Zammad: Titles of knowledge base answers will be shown across all categories via the global search

• zammad
• Information disclosure
• Broken access control

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

• The Wikimedia Foundation Mediawiki - WikiLambda Extension
• CWE-280

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-280

Dell SmartFabric Manager: Dell SmartFabric Manager, versions prior to 2.2.1…

• Dell SmartFabric Manager
• CWE-280

Secomea GateManager: Improper handling of insufficient permissions or privileges vulnerability in Secomea…

• Secomea GateManager
• CWE-280

This issue was addressed with additional entitlement checks.

• Apple macOS
• CWE-280

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-280

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-280

This issue was addressed with additional entitlement checks.

• Apple macOS
• CWE-280

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.

• Samsung Mobile Devices
• CWE-280

Windows Enterprise App Management Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-280

Local privilege escalation

• Zscaler Client Connector
• CWE-280

Wagtail: Improper restriction handling on Page translation API endpoint

• CWE-280

<7.0.9 || >=7.1rc1, <7.3.4 || >=7.4rc1, <7.4.3 || >=8.0rc1, <8.0rc2 · fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2

Wagtail: Improper permission handling when copying snippets

• CWE-280

<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2 · fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

• CWE-280

<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2 · fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2

Wagtail: Identification of documents by SHA1 hash

• CWE-280

<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2 · fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2

Wagtail: Improper restriction handling on Pages admin API

• CWE-280

<7.0.9 || >=7.1, <7.3.4 || >=7.4, <7.4.3 || >=8.0rc1, <8.0rc2 · fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2

Wagtail: Pages translations can be created without page permissions when using simple_translation

• CWE-280

<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2 · fixed in 7.0.8, 7.3.3, 7.4.2

Wagtail: Improper permission handling in image preview

• CWE-280

<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2 · fixed in 7.0.8, 7.3.3, 7.4.2

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

• CWE-280

<7.0.8 || >=7.1, <7.3.3 || >=7.4, <7.4.2 · fixed in 7.0.8, 7.3.3, 7.4.2

Apache Allura: Missing permission checks IDOR

• Apache Software Foundation Apache Allura
• Broken access control
• CWE-280

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

• CWE-280
• CWE-289

<1.2.13 · fixed in 1.2.13

Velociraptor incorrect Org deletion permissions check

• Rapid7 Velociraptor
• CWE-280

Program Module Vulnerability

• Tridium Niagara Framework
• Tridium Niagara Enterprise Security
• CWE-280

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

• Broken access control
• CWE-280

<1.27.0 · fixed in 1.27.0

Apache Kylin: Improper authorization in job information retrieval

• Apache Software Foundation Apache Kylin
• CWE-280

GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel

• Imagination Technologies Graphics DDK
• CWE-280

In Modem, there is a possible escalation of privilege due to a permissions bypass.

• MediaTek, Inc. MediaTek chipset
• CWE-280

GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted

• Imagination Technologies Graphics DDK
• CWE-280

Apache Kvrocks: Improper permission for the APPLYBATCH command

• Apache Software Foundation Apache Kvrocks
• CWE-280

Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

• Microsoft Dynamics 365 (on-premises) version 9.1
• CWE-280

Data exposed without proper permission

• pretix
• CWE-280

Privilege escalation in Yandex Database

• Yandex Database
• CWE-280

Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

• CWE-280

>=26.5.0, <26.6.3 || <=26.4.7 · fixed in 26.6.3

selinux: fix overlayfs mmap() and mprotect() access checks

• Linux kernel
• Broken access control
• CWE-280

Samba: vfs_worm does not block directory modification

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-280

Wagtail has improper permission handling when copying pages

• CWE-280

<7.0.7 || >=7.1, <7.3.2 · fixed in 7.0.7, 7.3.2

Wagtail has improper restriction handling on Documents and Images API

• CWE-280

<7.0.7 || >=7.1, <7.3.2 · fixed in 7.0.7, 7.3.2

Wagtail has improper permission handling when deleting form submissions

• CWE-280

<7.0.7 || >=7.1, <7.3.2 · fixed in 7.0.7, 7.3.2

Wagtail has improper permission handling when viewing page history

• CWE-280

<7.0.7 || >=7.1, <7.3.2 · fixed in 7.0.7, 7.3.2

Wagtail has improper permission handling when comparing revisions

• CWE-280

<7.0.7 || >=7.1, <7.3.2 · fixed in 7.0.7, 7.3.2

Vulnerability on Cryptobox external sharing feature

• Ercom Cryptobox
• CWE-280

In geniezone, there is a possible escalation of privilege due to a missing permission check.

• MediaTek, Inc. MediaTek chipset
• CWE-280

GPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)

• Imagination Technologies Graphics DDK
• CWE-20
• CWE-280

Windows Installer Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-280

Insufficient permission validation on multiple REST API Quick Setup endpoints

• Checkmk
• CWE-280

Privilege escalation vulnerability in Operations Agent

• OpenText Operations Agent
• CWE-280

Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

• CWE-280

<26.5.6 · fixed in 26.5.6

GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled

• Imagination Technologies Graphics DDK
• CWE-280

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check.

• Google Android
• CWE-280

RTU500 web interface: An unprivileged user can read user management information.

• Hitachi Energy RTU500 series CMU firmware
• CWE-280

Dell Update Package: Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00…

• Dell Update Package
• CWE-280

Moodle authentication bypass vulnerability

• CWE-280

<4.1.22 || >=4.4.0-beta, <4.4.12 || >=4.5.0-beta, <4.5.8 || >=5.0.0-beta, <5.0.4 || >=5.1.0-beta, <5.1.1 · fixed in 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1

Windows Error Reporting Service Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• CWE-280