CWEweakness

CWE-274 Improper Handling of Insufficient Privileges

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation.

Common consequences

• Other: Other, Alter Execution Logic — This can lead to resultant weaknesses.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2001-1564: System limits are not properly enforced after privileges are dropped. • CVE-2005-3286: Firewall crashes when it can't read a critical memory block that was protected by a malicious process. • CVE-2005-1641: Does not give admin sufficient privileges to overcome otherwise legitimate user actions.

Related

Observed example · CVE (3)

  • CVE-2005-3286 The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by… vulnerability
  • CVE-2005-1641 mod_channel in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not allow protected operators to… vulnerability
  • CVE-2001-1564 setrlimit in HP-UX 10.01, 10.10, 10.24, 10.20, 11.00, 11.04 and 11.11 does not properly enforce core file size on processes after setuid or… vulnerability

Can also be · CWE (1)

  • CWE-280 Improper Handling of Insufficient Permissions or Privileges weakness

Child of · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

Peer of · CWE (1)

  • CWE-271 Privilege Dropping / Lowering Errors weakness

Referenced by CVE · weakness (42)

  • CVE-2026-62764 Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. vulnerability
  • CVE-2025-54511 Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a… vulnerability
  • CVE-2026-33005 Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. vulnerability
  • CVE-2025-62175 Mastodon is a free, open-source social network server based on ActivityPub. vulnerability
  • CVE-2023-20516 Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs)… vulnerability
  • CVE-2025-29365 spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL. vulnerability
  • CVE-2025-31275 A permissions issue was addressed with additional restrictions. vulnerability
  • CVE-2025-20177 A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR image… vulnerability
  • CVE-2024-46974 Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers. vulnerability
  • CVE-2025-20156 A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate… vulnerability
  • CVE-2024-12666 A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. vulnerability
  • CVE-2024-0105 NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. vulnerability
  • CVE-2024-0106 NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper… vulnerability
  • CVE-2024-41942 JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. vulnerability
  • CVE-2024-20324 A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to access WLAN… vulnerability
  • CVE-2024-21648 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability
  • CVE-2023-39375 SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges vulnerability
  • CVE-2023-32494 Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. vulnerability
  • CVE-2023-35928 Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. vulnerability
  • CVE-2022-45101 Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS. vulnerability
  • CVE-2022-0668 JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted… vulnerability
  • CVE-2022-23511 A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon… vulnerability
  • CVE-2022-25782 Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update… vulnerability
  • CVE-2022-23160 Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. vulnerability
  • CVE-2021-32006 This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. vulnerability
  • CVE-2021-35534 Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650,… vulnerability
  • CVE-2020-24676 In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. vulnerability
  • CVE-2020-7283 Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via… vulnerability
  • CVE-2020-7264 Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete… vulnerability
  • CVE-2020-7265 Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user… vulnerability
Show all 42 ›

Referenced by OWASP · mapped cwe (1)

  • A10:2025 Mishandling of Exceptional Conditions Top 10 2025