CWE-270 · Access Control
Privilege Context Switching Error
24CVEs
SortMost likely exploited
24 CVEs with CWE-270 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-3493In CISA KEVExploitedThe overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system.…Ubuntu · linux kernel · CVSS 8.8 · 2021-04-17 | 8.8 | 49% | 2021-04-17 |
| CVE-2023-26475XWiki Platform vulnerable to Remote Code Execution in Annotationsxwiki · xwiki-platform · CVSS 10 · 2023-03-02 | 10.0 | 64% | 2023-03-02 |
| CVE-2023-25754Apache Airflow: Privilege escalation using airflow logsApache Software Foundation · Apache Airflow · CVSS 9.8 · 2023-05-08 | 9.8 | 2.3% | 2023-05-08 |
| CVE-2023-37912XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macroxwiki · xwiki-rendering · CVSS 10 · 2023-10-25 | 10.0 | 1.5% | 2023-10-25 |
| CVE-2020-7019In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more pr…Elastic · Elasticsearch · 2020-08-18 | – | 1.4% | 2020-08-18 |
| CVE-2020-7020Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security p…Elastic · Elasticsearch · 2020-10-22 | – | 1.1% | 2020-10-22 |
| CVE-2026-88200Microsoft Office SharePoint Elevation of Privilege VulnerabilityMicrosoft · Microsoft SharePoint Server Subscription Edition · CVSS 8.8 · 2026-10-13 | 8.8 | 0.8% | 2026-10-13 |
| CVE-2024-8641Privilege Context Switching Error in GitLabGitLab · GitLab · CVSS 6.7 · 2024-09-12 | 6.7 | 0.6% | 2024-09-12 |
| CVE-2020-1719A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability i…Redhat · Wildfly · 2021-06-07 | – | 0.6% | 2021-06-07 |
| CVE-2024-12570Privilege Context Switching Error in GitLabGitLab · GitLab · CVSS 6.7 · 2024-12-12 | 6.7 | 0.5% | 2024-12-12 |
| CVE-2024-37294Aimeos denial of service vulnerability in SaaS and marketplace setupsaimeos · aimeos-core · CVSS 5.5 · 2024-06-11 | 5.5 | 0.4% | 2024-06-11 |
| CVE-2025-60721Windows Administrator Protection Elevation of Privilege VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 7.8 · 2025-11-11 | 7.8 | 0.4% | 2025-11-11 |
| CVE-2017-2663It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An…Red Hat · subscription-manager · CVSS 8.2 · 2018-07-27 | 8.2 | 0.4% | 2018-07-27 |
| CVE-2024-47173Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setupsaimeos · ai-admin-graphql · CVSS 5.5 · 2024-10-24 | 5.5 | 0.4% | 2024-10-24 |
| CVE-2025-55210FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional ScopesFreePBX · api · CVSS 2 · 2026-02-12 | 2.0 | 0.4% | 2026-02-12 |
| CVE-2025-49583XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin rightxwiki · xwiki-platform · CVSS 5.1 · 2025-06-13 | 5.1 | 0.3% | 2025-06-13 |
| CVE-2024-51987HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnectDuendeSoftware · Duende.AccessTokenManagement · CVSS 5.4 · 2024-11-07 | 5.4 | 0.2% | 2024-11-07 |
| CVE-2024-36513A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated u…Fortinet · FortiClientWindows · CVSS 7.4 · 2024-11-12 | 7.4 | 0.2% | 2024-11-12 |
| CVE-2026-34853Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.Huawei · HarmonyOS · CVSS 7.7 · 2026-04-13 | 7.7 | 0.2% | 2026-04-13 |
| CVE-2024-11263arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=yzephyrproject-rtos · Zephyr · CVSS 9.4 · 2024-11-15 | 9.4 | 0.2% | 2024-11-15 |
| CVE-2024-46975GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mappingImagination Technologies · Graphics DDK · CVSS 7.9 · 2025-02-22 | 7.9 | 0.2% | 2025-02-22 |
| CVE-2025-26499Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for ano…Wind River Studio Developer · Wind River Studio Developer · CVSS 6 · 2025-09-11 | 6.0 | 0.1% | 2025-09-11 |
| CVE-2025-46406A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged a…Gallagher · Command Centre Server · CVSS 5.6 · 2025-07-10 | 5.6 | 0.1% | 2025-07-10 |
| CVE-2025-9408Userspace privilege escalation vulnerability on Cortex Mzephyrproject-rtos · Zephyr · CVSS 8.2 · 2025-11-11 | 8.2 | 0.1% | 2025-11-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.