cve.bz

CWE-282: Improper Ownership Management

Filter

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

What the weakness is: CWE-282 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 2
  • CAPEC-17 Using Malicious Files Likelihood: High · Severity: Very High
  • CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-282, as MITRE names them. Credits.

Ask an AI about CWE-282

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-282: Improper Ownership Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/282.html and https://cve.bz/cve/cwe/282?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-108304EPSS 0.1%

    Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

  2. 5.3CVE-2026-86769EPSS 0.3%

    Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Au…

  3. 8.8CVE-2026-50130EPSS 0.3%

    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/…

  4. 6.3CVE-2026-40214EPSS 0.2%

    In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering…

  5. 6.0CVE-2026-3867EPSS 0.2%

    An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the…

  6. 6.5CVE-2026-23514EPSS 1.1%

    Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to …

  7. 4.3CVE-2025-67642EPSS 0.2%

    Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they ar…

  8. 6.3CVE-2025-57732EPSS 0.1%

    In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership

  9. 4.3CVE-2025-1112EPSS 0.2%

    IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to privileged users.

  10. 2.9CVE-2025-46416EPSS 0.2%

    The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix…

  11. 4.3CVE-2025-3629EPSS 0.2%

    IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to improper ownership management.

  12. 5.3CVE-2025-32946EPSS 0.4%

    This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associ…

  13. 4.3CVE-2025-32945EPSS 0.3%

    The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associ…

  14. 8.0CVE-2025-27254EPSS 0.2%

    CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.

  15. 5.4CVE-2024-13249EPSS 0.2%

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.

  16. 5.3CVE-2024-13246EPSS 0.3%

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.

  17. 5.4CVE-2024-43176EPSS 0.3%

    IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users.

  18. 6.4CVE-2024-47816EPSS 0.3%

    ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as some…

  19. 7.8CVE-2024-39755EPSS 0.4%

    A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigg…

  20. 5.3CVE-2024-8949EPSS 0.7%

    A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart Content Handler. The manipulation of the argument cart_id/i…

  21. 6.5CVE-2024-45104EPSS 0.2%

    A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.

  22. 4.3CVE-2024-45103EPSS 0.3%

    A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.

  23. 8.5CVE-2024-37999EPSS 0.1%

    A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privileges and network access. This could allow an authenticated local attacker to esca…

  24. 9.1CVE-2024-3383EPSS 0.6%

    A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriat…

  25. 6.5CVE-2023-7226EPSS 0.4%

    A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the component Admin Module. The manipulation of the argument id leads…

  26. 5.7CVE-2023-0989EPSS 0.5%

    An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to vi…

  27. 7.8CVE-2023-0386KEVExploitEPSS 7.9%

    A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another …

  28. 7.8CVE-2022-29187EPSS 0.4%

    Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by…

  29. 6.7CVE-2022-0026EPSS 0.2%

    A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute …

  30. 5.3CVE-2020-10632EPSS 0.5%

    Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner.

  31. 7.8CVE-2017-12189EPSS 0.3%

    It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for…