CWE-282 · Access Control
Improper Ownership Management
31CVEs
SortMost likely exploited
31 CVEs with CWE-282 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-0386In CISA KEVExploitedA flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a…Linux · Kernel · CVSS 7.8 · 2023-03-22 | 7.8 | 7.9% | 2023-03-22 |
| CVE-2026-23514Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Managementkiteworks · core · CVSS 8.8 · 2026-03-25 | 8.8 | 1.1% | 2026-03-25 |
| CVE-2024-8949SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership managementSourceCodester · Online Eyewear Shop · CVSS 6.3 · 2024-09-17 | 6.3 | 0.7% | 2024-09-17 |
| CVE-2024-3383PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)Palo Alto Networks · PAN-OS · CVSS 7.4 · 2024-04-10 | 7.4 | 0.6% | 2024-04-10 |
| CVE-2023-0989Improper Ownership Management in GitLabGitLab · GitLab · CVSS 4.3 · 2023-09-29 | 4.3 | 0.5% | 2023-09-29 |
| CVE-2020-10632ICSA-20-140-02 Emerson OpenEnterpriseEmerson · OpenEnterprise SCADA Software · CVSS 8.8 · 2022-02-24 | 8.8 | 0.5% | 2022-02-24 |
| CVE-2022-29187Bypass of safe.directory protections in Gitgit · git · CVSS 7.8 · 2022-07-12 | 7.8 | 0.4% | 2022-07-12 |
| CVE-2023-7226meetyoucrop big-whale Admin Module all.api improper ownership managementmeetyoucrop · big-whale · CVSS 6.3 · 2024-01-11 | 6.3 | 0.4% | 2024-01-11 |
| CVE-2025-32946PeerTube Arbitrary Playlist Creation via ActivityPub ProtocolFramasoft · Peertube · CVSS 5.3 · 2025-04-15 | 5.3 | 0.4% | 2025-04-15 |
| CVE-2024-39755A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute priviledged operation. A…Veertu · Anka Build · CVSS 7.8 · 2024-10-03 | 7.8 | 0.4% | 2024-10-03 |
| CVE-2024-45103A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.Lenovo · XClarity Administrator · CVSS 4.3 · 2024-09-13 | 4.3 | 0.3% | 2024-09-13 |
| CVE-2017-12189It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege…Red Hat, Inc. · Red Hat JBoss Enterprise Application Platform · 2018-01-10 | – | 0.3% | 2018-01-10 |
| CVE-2024-47816Users can impersonate import requesters if their actor IDs coincide in ImportDumpmiraheze · ImportDump · CVSS 6.4 · 2024-10-09 | 6.4 | 0.3% | 2024-10-09 |
| CVE-2025-32945PeerTube Arbitrary Playlist Creation via REST APIFramasoft · Peertube · CVSS 4.3 · 2025-04-15 | 4.3 | 0.3% | 2025-04-15 |
| CVE-2024-43176IBM OpenPages information disclosureIBM · OpenPages · CVSS 5.4 · 2025-01-09 | 5.4 | 0.3% | 2025-01-09 |
| CVE-2026-86769Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkoutgrokability · snipe-it · CVSS 4.3 · 2026-09-09 | 4.3 | 0.3% | 2026-09-09 |
| CVE-2024-13246Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010Drupal · Node Access Rebuild Progressive · CVSS 5.3 · 2025-01-09 | 5.3 | 0.3% | 2025-01-09 |
| CVE-2026-50130Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`pi-hole · pi-hole · CVSS 8.8 · 2026-07-14 | 8.8 | 0.3% | 2026-07-14 |
| CVE-2025-67642Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission…Jenkins Project · Jenkins HashiCorp Vault Plugin · CVSS 4.3 · 2025-12-10 | 4.3 | 0.2% | 2025-12-10 |
| CVE-2026-3867An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may acces…Moxa · EDR-8010 Series · CVSS 6 · 2026-04-27 | 6.0 | 0.2% | 2026-04-27 |
| CVE-2025-1112IBM OpenPages with Watson information disclosureIBM · OpenPages with Watson · CVSS 4.3 · 2025-07-09 | 4.3 | 0.2% | 2025-07-09 |
| CVE-2022-0026Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks · Cortex XDR Agent · CVSS 6.7 · 2022-05-11 | 6.7 | 0.2% | 2022-05-11 |
| CVE-2024-13249Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013Drupal · Node Access Rebuild Progressive · CVSS 5.4 · 2025-01-09 | 5.4 | 0.2% | 2025-01-09 |
| CVE-2025-3629IBM InfoSphere Information Server file manipulationIBM · InfoSphere Information Server · CVSS 4.3 · 2025-06-21 | 4.3 | 0.2% | 2025-06-21 |
| CVE-2026-40214In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NUL…OpenStack · Cyborg · CVSS 6.3 · 2026-05-07 | 6.3 | 0.2% | 2026-05-07 |
| CVE-2024-45104A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.Lenovo · XClarity Administrator · CVSS 6.3 · 2024-09-13 | 6.3 | 0.2% | 2024-09-13 |
| CVE-2025-27254CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows…GE Vernova · EnerVista UR Setup · CVSS 8 · 2025-03-10 | 8.0 | 0.2% | 2025-03-10 |
| CVE-2025-46416The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This…NixOS · Nix · CVSS 2.9 · 2025-06-27 | 2.9 | 0.2% | 2025-06-27 |
| CVE-2024-37999A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privileges and network acce…Siemens · Medicalis Workflow Orchestrator · CVSS 7.8 · 2024-07-08 | 7.8 | 0.1% | 2024-07-08 |
| CVE-2025-57732In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownershipJetBrains · TeamCity · CVSS 7.5 · 2025-08-20 | 7.5 | 0.1% | 2025-08-20 |
| CVE-2026-126329Docker Sandboxes privilege escalation through untrusted state directoriesDocker · Docker Sandboxes · CVSS 7.3 · 2026-11-12 | 7.3 | 0.1% | 2026-11-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.