CAPEC-122
Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
On this page
If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts.
This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-122: Privilege Abuse: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/122.html and https://cve.bz/cve/capec/122?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The target must have misconfigured their access control mechanisms such that sensitive information, which should only be accessible to more trusted users, remains accessible to less trusted users.
The adversary must have access to the target, albeit with an account that is less privileged than would be appropriate for the targeted resources.
Skills required
- Low skill
Adversary can leverage privileged features they already have access to without additional effort or skill. Adversary is only required to have access to an account with improper priveleges.
Resources required
None: No specialized resources are required to execute this type of attack. The ability to access the target is required.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Read Data | Confidentiality | |
| Execute Unauthorized Commands | Authorization | Run Arbitrary Code |
| Gain Privileges | Authorization | |
| Bypass Protection Mechanism | Access Control, Authorization |
Mitigations
Configure account privileges such privileged/administrator functionality is not exposed to non-privileged/lower accounts.
Weaknesses it exploits
- CWE-269 Improper Privilege Management
- CWE-732 Incorrect Permission Assignment for Critical Resource
- CWE-1317 Improper Access Control in Fabric Bridge
Recent CVEs with these weaknesses
- 8.6CVE-2026-112191
In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permi…
- 3.9CVE-2026-14543
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…
- 7.4CVE-2026-12963
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
- 7.3CVE-2026-112125
Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.
- 8.6CVE-2026-125382
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. A…
- 8.6CVE-2026-125364
frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or …
- 8.6CVE-2026-125360
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled accou…
- 7.8CVE-2026-114031
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. Th…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Can lead to
- CAPEC-664 Server Side Request Forgery
Examples
Improperly configured account privileges allowed unauthorized users on a hospital's network to access the med…
Improperly configured account privileges allowed unauthorized users on a hospital's network to access the medical records for over 3,000 patients. Thus compromising data integrity and confidentiality in addition to HIPAA violations.
MITRE's words, unchanged: CAPEC-122 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.