# CWE-283.

Every Advisory and CVE whose sources give the weakness CWE-283, newest first.

## Records, newest first

- [filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion](https://agentprime.io/advisories/GHSA-9c4x-gm8v-wgc4.md)
  `GHSA-9c4x-gm8v-wgc4`, `CVE-2026-112911` · PyPI `filelock`: affected `>=3.30.0, <4.2.1`, fixed in `4.2.1` · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-283
- [Unverified ownership of the default Athena query result location in AWS SDK for pandas](https://agentprime.io/advisories/CVE-2026-118029.md)
  `CVE-2026-118029` · CVE record: aws aws-sdk-pandas · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-283
- [Windows Virtual Input Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83791.md)
  `CVE-2026-83791` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-283
- [Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution](https://agentprime.io/advisories/CVE-2026-110237.md)
  `CVE-2026-110237` · CVE record: vifm vifm · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-283
- [Barman snapshot backup deletion trusts unverified backup catalog metadata](https://agentprime.io/advisories/CVE-2026-93853.md)
  `CVE-2026-93853` · CVE record: EnterpriseDB Barman · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-283
- [Missing S3 bucket ownership verification in the AWS Security Agent MCP server](https://agentprime.io/advisories/CVE-2026-87913.md)
  `CVE-2026-87913` · CVE record: AWS AWS Security Agent MCP server · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-283, CWE-341
- [Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops](https://agentprime.io/advisories/CVE-2026-87912.md)
  `CVE-2026-87912` · CVE record: AWS AWS Security Agent plugin · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-283, CWE-341
- [gix-sec safe.directory protections absent for elevated administrators](https://agentprime.io/advisories/GHSA-7rhf-42qf-vrvc.md)
  `GHSA-7rhf-42qf-vrvc`, `CVE-2025-24890` · crates.io `gix-sec`: affected `<0.13.3`, fixed in `0.13.3` · CVSS 6.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-283
- [Fortinet FortiClientWindows: A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7…](https://agentprime.io/advisories/CVE-2026-84386.md)
  `CVE-2026-84386` · CVE record: Fortinet FortiClientWindows · CVSS 4.7 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-283
- [Unverified access point ownership in Amazon EFS CSI Driver](https://agentprime.io/advisories/CVE-2026-85781.md)
  `CVE-2026-85781` · CVE record: aws aws-efs-csi-driver · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-283
- [Vulnerabilities exists in IBM Netezza Software](https://agentprime.io/advisories/CVE-2026-9745.md)
  `CVE-2026-9745` · CVE record: IBM Netezza Software · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-283
- [TrustedFirmware Trusted Firmware-M: On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e…](https://agentprime.io/advisories/CVE-2026-54467.md)
  `CVE-2026-54467` · CVE record: TrustedFirmware Trusted Firmware-M · CVSS 7.0 High · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-283
- [Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner](https://agentprime.io/advisories/CVE-2026-15599.md)
  `CVE-2026-15599` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner · CVSS 3.3 Low · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-283
- [Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts](https://agentprime.io/advisories/CVE-2026-44707.md)
  `CVE-2026-44707` · CVE record: chatwoot chatwoot · CVSS 6.8 Medium · Not analysed yet · Published 26 May 2026 · Tags: Authentication bypass, CWE-283
- [Open WebUI's Model Import Overwrites Any Model Without Ownership Check](https://agentprime.io/advisories/GHSA-mqq6-cqcx-38vg.md)
  `GHSA-mqq6-cqcx-38vg`, `CVE-2026-44562`, `PYSEC-2026-2749` · PyPI `open-webui`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: Broken access control, CWE-283
- [Sentry kernel has incomplete ownership check for IRQ line manipulation](https://agentprime.io/advisories/CVE-2026-40337.md)
  `CVE-2026-40337` · CVE record: camelot-os sentry-kernel · CVSS 5.1 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-283
- [TSPortal: Any user can forge self-deletion requests for any account](https://agentprime.io/advisories/GHSA-gfhq-7499-f3f2.md)
  `GHSA-gfhq-7499-f3f2`, `CVE-2026-29788`, `PKSA-95py-dkb3-3t1y` · Packagist `miraheze/ts-portal`: affected `<30`, fixed in `30` · CVSS 8.4 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-283, CWE-1287
- [Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit](https://agentprime.io/advisories/GHSA-xfhr-q72q-jcrj.md)
  `GHSA-xfhr-q72q-jcrj`, `CVE-2026-4269`, `PYSEC-2026-2396` · PyPI `bedrock-agentcore-starter-toolkit`: affected `<0.1.13`, fixed in `0.1.13` · CVSS 5.8 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-283, CWE-340
- [OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup](https://agentprime.io/advisories/GHSA-jfv4-h8mc-jcp8.md)
  `GHSA-jfv4-h8mc-jcp8`, `CVE-2026-27486` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 4.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-283
- [Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization](https://agentprime.io/advisories/GHSA-g7vw-f8p5-c728.md)
  `GHSA-g7vw-f8p5-c728`, `CVE-2026-26016`, `PKSA-773t-3wms-bb2z` · Packagist `pterodactyl/panel`: affected `<1.12.1`, fixed in `1.12.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Feb 2026 · Tags: Broken access control, CWE-283
- [Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api](https://agentprime.io/advisories/CVE-2026-0598.md)
  `CVE-2026-0598` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 6 Feb 2026 · Tags: CWE-283
- [Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea](https://agentprime.io/advisories/GHSA-4xx9-vc8v-87hv.md)
  `GHSA-4xx9-vc8v-87hv`, `BIT-gitea-2026-20912`, `CVE-2026-20912`, `GHSA-vfmv-f93v-37mw`, `GO-2026-4364` · Go `code.gitea.io/gitea`: affected `<1.25.4`, fixed in `1.25.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: Broken access control, CWE-283
- [AWS Research and Engineering Studio (RES): An ownership verification issue in the Virtual Desktop preview page in the Research and…](https://agentprime.io/advisories/CVE-2025-12815.md)
  `CVE-2025-12815` · CVE record: AWS Research and Engineering Studio (RES) · CVSS 5.3 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-283
- [IBM Business Automation Insights unverified ownership](https://agentprime.io/advisories/CVE-2025-36091.md)
  `CVE-2025-36091` · CVE record: IBM Cloud Pak For Business Automation · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: CWE-283
- [Mautic vulnerable to secret data extraction via elfinder](https://agentprime.io/advisories/GHSA-438m-6mhw-hq5w.md)
  `GHSA-438m-6mhw-hq5w`, `CVE-2025-9822`, `PKSA-bn7t-4gr8-g6ns` · Packagist `mautic/core`: affected `>=4.4.0, <4.4.17 || >=5.0.0-alpha, <5.2.8 || >=6.0.0-alpha, <6.0.5`, fixed in `4.4.17`, `5.2.8`, `6.0.5` · CVSS 5.5 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-283
- [Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability.](https://agentprime.io/advisories/CVE-2025-43882.md)
  `CVE-2025-43882` · CVE record: Dell ThinOS 10 · CVSS 7.8 High · Not analysed yet · Published 27 Aug 2025 · Tags: CWE-283
- [TYPO3 Allows Privilege Escalation to System Maintainer](https://agentprime.io/advisories/GHSA-6frx-j292-c844.md)
  `GHSA-6frx-j292-c844`, `CVE-2025-47940`, `PKSA-2ssc-6m7w-s9xh` · Packagist `typo3/cms-core`: affected `>=10.4.0, <10.4.50 || >=11.0.0, <11.5.44 || >=12.0.0, <12.4.31 || >=13.0.0, <13.4.12`, fixed in `10.4.50`, `11.5.44`, `12.4.31`, `13.4.12` · CVSS 7.2 High · Not analysed yet · Published 20 May 2025 · Tags: CWE-283
- [Improper Authorization in /user/namespace/{namespace}/details](https://agentprime.io/advisories/CVE-2025-1007.md)
  `CVE-2025-1007` · CVE record: Eclipse Foundation OpenVSX · CVSS 6.9 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Broken access control, CWE-283
- [OpenVPN 2: OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any…](https://agentprime.io/advisories/CVE-2024-27903.md)
  `CVE-2024-27903` · CVE record: OpenVPN OpenVPN 2 · CVSS 7.2 High · Not analysed yet · Published 8 Jul 2024 · Tags: CWE-283
- [Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination](https://agentprime.io/advisories/CVE-2024-1853.md)
  `CVE-2024-1853` · CVE record: Zemena AntiLogger · CVSS 5.5 Medium · Not analysed yet · Published 14 Mar 2024 · Tags: CWE-283
- [On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in so…](https://agentprime.io/advisories/CVE-2023-6068.md)
  `CVE-2023-6068` · CVE record: Arista Networks MOS · CVSS 3.1 Low · Not analysed yet · Published 4 Mar 2024 · Tags: CWE-283
- [kiwi TCMS has possibility for user to update email address to unverified one](https://agentprime.io/advisories/GHSA-7x6q-3v3m-cwjg.md)
  `GHSA-7x6q-3v3m-cwjg`, `CVE-2023-30544`, `PYSEC-2026-1497` · PyPI `kiwitcms`: affected `<12.2`, fixed in `12.2` · CVSS 3.9 Low · Not analysed yet · Published 24 Apr 2023 · Tags: Broken access control, CWE-283
- [No verification of commits origin in github-action-merge-dependabot](https://agentprime.io/advisories/CVE-2022-29220.md)
  `CVE-2022-29220` · CVE record: fastify github-action-merge-dependabot · CVSS 6.5 Medium · Not analysed yet · Published 31 May 2022 · Tags: CWE-283
- [Unverified Ownership in Kubernetes](https://agentprime.io/advisories/GHSA-j9wf-vvm6-4r9w.md)
  `GHSA-j9wf-vvm6-4r9w`, `CVE-2020-8554` · Go `k8s.io/kubernetes`: affected `<=1.22.0`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 8 Feb 2022 · Tags: CWE-283
- [Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions](https://agentprime.io/advisories/CVE-2021-24501.md)
  `CVE-2021-24501` · CVE record: Unknown Workreap · No CVSS score · Not analysed yet · Published 9 Aug 2021 · Tags: Broken access control, CWE-283
- [Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities](https://agentprime.io/advisories/CVE-2021-24500.md)
  `CVE-2021-24500` · CVE record: Unknown Workreap · No CVSS score · Not analysed yet · Published 9 Aug 2021 · Tags: Broken access control, CWE-283

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-283>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-283/>. Everything for agents: <https://agentprime.io/llms.txt>.