CWE-283: Unverified Ownership
The product does not properly verify that a critical resource is owned by the proper entity.
A kind of CWE-282 Improper Ownership Management.
From the CWE List. © The MITRE Corporation.
Newest
- aws aws-sdk-pandas Unverified ownership of the default Athena query result location in AWS SDK for pandas 5.9 Medium
- tox-dev filelock filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion 6.3 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 more Windows Virtual Input Elevation of Privilege Vulnerability 7.8 High
- vifm Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution 7.0 High
- enterprisedb barman Barman snapshot backup deletion trusts unverified backup catalog metadata 7.2 High
- aws security agent mcp server Missing S3 bucket ownership verification in the AWS Security Agent MCP server 5.1 Medium
- aws security agent plugin Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops 5.1 Medium
- gitoxidelabs gitoxide gix-sec safe.directory protections absent for elevated administrators 6.8 Medium
- fortinet forticlientwindows A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7,... 4.7 Medium
- aws aws-efs-csi-driver Unverified access point ownership in Amazon EFS CSI Driver 5.1 Medium
- ibm netezza software, netezza performance server +1 more Vulnerabilities exists in IBM Netezza Software 6.5 Medium
- trustedfirmware trusted firmware-m On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization... 7.0 High
- tubitak bilgem software technologies research institute pardus-domain-joiner Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner 3.3 Low
- chatwoot Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts 6.8 Medium
- openwebui open webui, open-webui +1 more Open WebUI: Model Import Overwrites Any Model Without Ownership Check 6.5 Medium
- camelot-os sentry-kernel Sentry kernel has incomplete ownership check for IRQ line manipulation 5.1 Medium
- amazon bedrock agentcore starter toolkit Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit 5.8 Medium
- miraheze tsportal TSPortal: Anyone can forge self-deletion requests of any user 8.4 High
- openclaw OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup 4.3 Medium
- convoypanel panel Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization 9.2 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6 +1 more Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api 4.2 Medium
- gitea, gitea open source git server, red hat openshift pipelines +2 more Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure 9.1 Critical
- aws research and engineering studio (res) An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another us… 5.3 Medium
- ibm cloud pak for business automation IBM Business Automation Insights unverified ownership 4.3 Medium
- mautic Secret data extraction via elfinder 5.5 Medium
- dell thinos, thinos 10 +1 more Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A... 7.8 High
- typo3 TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer 7.2 High
- eclipse foundation openvsx, eclipse open vsx +1 more Improper Authorization in /user/namespace/{namespace}/details 6.9 Medium
- openvpn, openvpn 2, openvpn2 +2 more OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory,... 9.8 Critical
- zemana antilogger Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination 5.5 Medium
- arista multiaccess, arista networks mos +1 more On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in som… 3.1 Low
- kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS may allow user to update email address to unverified one 3.9 Low
- fastify github-action-merge-dependabot, github action merge dependabot +1 more No verification of commits origin in github-action-merge-dependabot 6.5 Medium
- amentotech workreap Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions 8.1 High
- amentotech workreap Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities 8.1 High
- kubernetes, oracle communications cloud native core network slice selection function, communications cloud native core policy +1 more +3 more Kubernetes man in the middle using LoadBalancer or ExternalIPs 6.3 Medium