cve.bz

CWE-648: Incorrect Use of Privileged APIs

Filter

The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

What the weakness is: CWE-648 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-107 Cross Site Tracing Likelihood: Medium · Severity: Very High
  • CAPEC-234 Hijacking a privileged process Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-648, as MITRE names them. Credits.

Ask an AI about CWE-648

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-648: Incorrect Use of Privileged APIs and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/648.html and https://cve.bz/cve/cwe/648?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.5CVE-2026-125396EPSS 0.1%

    Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PD…

  2. 7.3CVE-2026-112177EPSS 0.4%

    A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insuf…

  3. 10.0CVE-2026-76460KEVExploitEPSS 76%

    A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker…

  4. 8.7CVE-2026-63727EPSS 0.4%

    Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API ca…

  5. 8.4CVE-2026-54424EPSS 0.2%

    An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A …

  6. 6.3CVE-2026-11877EPSS 0.3%

    An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

  7. 9.4CVE-2026-9560EPSS 0.6%

    Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

  8. 8.6CVE-2026-41225EPSS 0.3%

    A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.  Note: Software versions which have reached E…

  9. 9.1CVE-2026-41386EPSS 0.3%

    OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate pr…

  10. 9.0CVE-2026-41329EPSS 0.3%

    OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to by…

  11. 7.1CVE-2025-54502EPSS 0.1%

    Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.

  12. 8.7CVE-2026-35669EPSS 0.3%

    OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope bo…

  13. 8.7CVE-2026-35663EPSS 0.3%

    OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining…

  14. 6.1CVE-2026-35645EPSS 0.3%

    OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session del…

  15. 8.7CVE-2026-35639EPSS 0.5%

    OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually h…

  16. 8.5CVE-2026-35625EPSS 0.2%

    OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can e…

  17. 7.8CVE-2026-20126EPSS 0.3%

    A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authenticati…

  18. 5.4CVE-2026-20122KEVEPSS 26%

    A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credenti…

  19. 6.5CVE-2026-22922EPSS 0.4%

    Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgr…

  20. 7.1CVE-2025-1161EPSS 0.2%

    Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.

  21. 5.4CVE-2025-63291EPSS 0.3%

    When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller. The Alteryx server did not check whether the authenticated user had permission …

  22. 8.5CVE-2024-32008EPSS 0.1%

    A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to an exposed debug interface on the localhost. This allows any local …

  23. 8.8CVE-2025-54769ExploitEPSS 3.6%

    An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve r…

  24. 5.3CVE-2025-54768EPSS 5.9%

    An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing s…

  25. 6.5CVE-2025-54767EPSS 8.5%

    An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.

  26. 5.3CVE-2025-54766EPSS 10%

    An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive inf…

  27. 5.3CVE-2025-54765EPSS 10%

    An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker t…

  28. 8.8CVE-2025-5997EPSS 0.4%

    Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.

  29. 8.7CVE-2025-7344EPSS 0.6%

    The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a specific API.

  30. 7.8CVE-2025-23375EPSS 0.1%

    Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of pri…

  31. 8.7CVE-2022-26323EPSS 0.3%

    Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Classic and Containerized) allows Privilege Escalation.  The vulnerability could a…

  32. 9.0CVE-2025-2311EPSS 0.2%

    Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authent…

  33. 6.9CVE-2025-0589EPSS 0.4%

    In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associate…

  34. 6.4CVE-2024-53007EPSS 0.1%

    Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.

  35. 5.3CVE-2024-8785EPSS 9.7%

    In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.

  36. 9.8CVE-2024-11068EPSS 1.2%

    The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using …

  37. 6.5CVE-2024-46978EPSS 0.5%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it.…

  38. 9.1CVE-2024-37018EPSS 0.4%

    The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.

  39. 7.2CVE-2023-6522EPSS 0.3%

    Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3914.

  40. 7.5CVE-2023-4993EPSS 0.4%

    Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users. This issue affects SoliPay Mobile App: before 5.0.8.

  41. 7.8CVE-2024-22042EPSS 0.1%

    A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host (conhost.exe) as a child process with SYS…

  42. 7.5CVE-2023-6151EPSS 0.6%

    Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105.

  43. 7.5CVE-2023-6150EPSS 0.6%

    Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105.

  44. 9.8CVE-2023-4972EPSS 0.7%

    Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1.

  45. 7.2CVE-2023-4009EPSS 0.8%

    In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege es…

  46. 6.5CVE-2023-20136EPSS 0.5%

    A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid…

  47. 7.2CVE-2023-29507EPSS 0.9%

    XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent execu…

  48. 8.8CVE-2023-28062EPSS 0.8%

    Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to bypass intended access restrictions and …

  49. 5.4CVE-2022-20965EPSS 0.6%

    A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface. This vulnerability is due to imp…

  50. 4.3CVE-2022-4805EPSS 0.5%

    Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.