CWEweakness

CWE-283 Unverified Ownership

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly verify that a critical resource is owned by the proper entity.

Common consequences

• Access Control: Gain Privileges or Assume Identity — An attacker could gain unauthorized access to system resources.

Potential mitigations

• [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software. • [Architecture and Design] Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Observed examples

• CVE-2001-0178: Program does not verify the owner of a UNIX socket that is used for sending a password. • CVE-2004-2012: Owner of special device not checked, allowing root.

Related

Observed example · CVE (2)

  • CVE-2004-2012 The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not… vulnerability
  • CVE-2001-0178 kdesu program in KDE2 (KDE before 2.2.0-6) does not properly verify the owner of a UNIX socket that is used to send a password, which… vulnerability

Child of · CWE (1)

  • CWE-282 Improper Ownership Management weakness

Referenced by CVE · weakness (36)

  • CVE-2026-118029 Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might… vulnerability
  • CVE-2026-112911 filelock is a platform-independent file lock for Python. vulnerability
  • CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local… vulnerability
  • CVE-2026-83791 Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2026-93853 Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete… vulnerability
  • CVE-2025-24890 gitoxide is an implementation of git written in Rust. vulnerability
  • CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow… vulnerability
  • CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain… vulnerability
  • CVE-2026-84386 A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow… vulnerability
  • CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an… vulnerability
  • CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the… vulnerability
  • CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure,… vulnerability
  • CVE-2026-15599 Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. vulnerability
  • CVE-2026-44707 Chatwoot is a customer engagement suite. vulnerability
  • CVE-2026-44562 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. vulnerability
  • CVE-2026-40337 The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. vulnerability
  • CVE-2026-4269 A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code… vulnerability
  • CVE-2026-29788 TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and… vulnerability
  • CVE-2026-27486 OpenClaw is a personal AI assistant. vulnerability
  • CVE-2026-26016 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. vulnerability
  • CVE-2026-0598 A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. vulnerability
  • CVE-2026-20912 Gitea does not properly validate repository ownership when linking attachments to releases. vulnerability
  • CVE-2025-12815 An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version… vulnerability
  • CVE-2025-36091 IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become… vulnerability
  • CVE-2025-9822 SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally… vulnerability
  • CVE-2025-43882 Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. vulnerability
  • CVE-2025-47940 TYPO3 is an open source, PHP based web content management system. vulnerability
  • CVE-2025-1007 In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the… vulnerability
  • CVE-2024-27903 OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an… vulnerability
  • CVE-2024-1853 Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of… vulnerability
Show all 36 ›

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (1)

  • A01:2025 Broken Access Control Top 10 2025