Weakness (CWE)
CWE-648: Incorrect Use of Privileged APIs
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
More detail
When a product contains certain functions that perform operations requiring an elevated level of privilege, the caller of a privileged API must be careful to:
- ensure that assumptions made by the APIs are valid, such as validity of arguments
- account for known weaknesses in the design/implementation of the API
- call the API from a safe context
If the caller of the API does not follow these requirements, then it may allow a malicious user or process to elevate their privilege, hijack the process, or steal sensitive data.
For instance, it is important to know if privileged APIs do not shed their privileges before returning to the caller or if the privileged function might make certain assumptions about the data, context or state information passed to it by the caller. It is important to always know when and how privileged APIs can be called in order to ensure that their elevated level of privilege cannot be exploited.
How to prevent it (6 mitigations)
-
Implementation
Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
-
Architecture and Design
Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.
-
Implementation
If privileged APIs make certain assumptions about data, context or state validity that are passed by the caller, the calling code must ensure that these assumptions have been validated prior to making the call.
-
Implementation
If privileged APIs do not shed their privilege prior to returning to the calling code, then calling code needs to shed these privileges immediately and safely right after the call to the privileged APIs. In particular, the calling code needs to ensure that a privileged thread of execution will never be returned to the user or made available to user-controlled processes.
-
Implementation
Only call privileged APIs from safe, consistent and expected state.
-
Implementation
Ensure that a failure or an error will not leave a system in a state where privileges are not properly shed and privilege escalation is possible (i.e. fail securely with regards to handling of privileges).
Source: MITRE CWE-648
42 results · Clear filters · Feed
-
High 7.8
Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that tri…
-
High 7.3
Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected.…
-
High 8.8
Anchore Enterprise Privilege Escalation via User Management API
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modify…
-
High 8.4CVE-2026-54424 Public exploit
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Pr…
-
High 8.9CVE-2026-9560 Public exploit
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute…
-
High 7.1
Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacke…
-
High 8.8
OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gai…
-
High 8.8
OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unauthorized admini…
-
High 8.1
OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a requ…
-
High 8.8
OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can …
-
High 7.8
OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by trigg…
-
High 8.8
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the RES…
-
High 7.1
Improper Authorization in Nomysoft Informatics' Nomysem
Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.
-
High 7.8
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application …
-
High 8.8CVE-2025-54769 Public exploit
KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution …
-
High 8.8
Privilege Escalation in Beamsec PhishPro
Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.
-
High 8.8
Digiwin｜EAI - Privilege Escalation
The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a specific API.
-
High 7.8
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerabilit…
-
High 8.7
Incorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product.
Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Classic and Containerized) allows Privilege Escalation. The vulnerability could allow authenticated at…
-
High 7.2
Information Disclosure in ExtremePacs's Extreme XDS
Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3914.
-
High 7.5
Sensetive Data Exposure in Utarit's Soliclub
Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users. This issue affects SoliPay Mobile App: before 5.0.8.
-
High 7.8
A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product c…
-
High 7.5
Information Disclosure in Eskom E-municipality
Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105.
-
High 7.5
Information Disclosure in Eskom E-municipality
Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105.
-
High 7.2
Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
-
High 8.8
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated mal…
-
High 8.1
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.3
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
-
High 8.1
Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
-
High 7.1
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authentica…
-
High 7.5
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typicall…
-
High 8.1
Potential privilege escalation in Ops Manager API
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 ve…
-
High 7.2
Privilege escalation in setuid mode via user namespaces in Bubblewrap
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be…
-
High 7.3
A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properl…
-
High 7.3
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling sc…
-
High 7.3
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not prop…
-
High 7.3CVE-2019-14813 EPSS 11%
A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly s…
-
High 7.3
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not pro…
-
High 7.3CVE-2019-14811 Public exploit
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not proper…
-
High 7.3
It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6…