CWE-283.

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

• CWE-283

>=3.30.0, <4.2.1 · fixed in 4.2.1

Unverified ownership of the default Athena query result location in AWS SDK for pandas

• aws-sdk-pandas
• CWE-283

Windows Virtual Input Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-283

Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution

• vifm
• CWE-283

Barman snapshot backup deletion trusts unverified backup catalog metadata

• EnterpriseDB Barman
• CWE-283

Missing S3 bucket ownership verification in the AWS Security Agent MCP server

• AWS Security Agent MCP server
• CWE-283
• CWE-341

Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

• AWS Security Agent plugin
• CWE-283
• CWE-341

gix-sec safe.directory protections absent for elevated administrators

• CWE-283

<0.13.3 · fixed in 0.13.3

Fortinet FortiClientWindows: A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7…

• Fortinet FortiClientWindows
• CWE-283

Unverified access point ownership in Amazon EFS CSI Driver

• aws-efs-csi-driver
• CWE-283

Vulnerabilities exists in IBM Netezza Software

• IBM Netezza Software
• CWE-283

TrustedFirmware Trusted Firmware-M: On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e…

• TrustedFirmware Trusted Firmware-M
• CWE-283

Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner

• TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner
• CWE-283

Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts

• chatwoot
• Authentication bypass
• CWE-283

Open WebUI's Model Import Overwrites Any Model Without Ownership Check

• Broken access control
• CWE-283

<0.9.0 · fixed in 0.9.0

Sentry kernel has incomplete ownership check for IRQ line manipulation

• camelot-os sentry-kernel
• CWE-283

TSPortal: Any user can forge self-deletion requests for any account

• CWE-283
• CWE-1287

<30 · fixed in 30

Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

• CWE-283
• CWE-340

<0.1.13 · fixed in 0.1.13

OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup

• CWE-283

<2026.2.14 · fixed in 2026.2.14

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

• Broken access control
• CWE-283

<1.12.1 · fixed in 1.12.1

Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2
• CWE-283

Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

• Broken access control
• CWE-283

<1.25.4 · fixed in 1.25.4

AWS Research and Engineering Studio (RES): An ownership verification issue in the Virtual Desktop preview page in the Research and…

• AWS Research and Engineering Studio (RES)
• CWE-283

IBM Business Automation Insights unverified ownership

• IBM Cloud Pak For Business Automation
• CWE-283

Mautic vulnerable to secret data extraction via elfinder

• CWE-283

>=4.4.0, <4.4.17 || >=5.0.0-alpha, <5.2.8 || >=6.0.0-alpha, <6.0.5 · fixed in 4.4.17, 5.2.8, 6.0.5

Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability.

• Dell ThinOS 10
• CWE-283

TYPO3 Allows Privilege Escalation to System Maintainer

• CWE-283

>=10.4.0, <10.4.50 || >=11.0.0, <11.5.44 || >=12.0.0, <12.4.31 || >=13.0.0, <13.4.12 · fixed in 10.4.50, 11.5.44, 12.4.31, 13.4.12

Improper Authorization in /user/namespace/{namespace}/details

• Eclipse Foundation OpenVSX
• Broken access control
• CWE-283

OpenVPN 2: OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any…

• OpenVPN 2
• CWE-283

Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination

• Zemena AntiLogger
• CWE-283

On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in so…

• Arista Networks MOS
• CWE-283

kiwi TCMS has possibility for user to update email address to unverified one

• Broken access control
• CWE-283

<12.2 · fixed in 12.2

No verification of commits origin in github-action-merge-dependabot

• fastify github-action-merge-dependabot
• CWE-283

Unverified Ownership in Kubernetes

• CWE-283

<=1.22.0 · no fixed version yet

Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions

• Workreap
• Broken access control
• CWE-283

Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

• Workreap
• Broken access control
• CWE-283