CWE-648: Incorrect Use of Privileged APIs
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
- red hat enterprise linux 8, enterprise linux 10, enterprise linux 6 +2 more +4 more Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 7.3 High
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 more Cisco Identity Services Engine Authentication Bypass Vulnerability 10.0 Critical
- anchore enterprise Anchore Enterprise Privilege Escalation via User Management API 8.7 High
- unity parsec An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a... 8.4 High
- microfocus access manager Missing Authorization Vulnerability in OpenText Access Manager 6.3 Medium
- openvpn connect Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS... 9.4 Critical
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 more iControl REST vulnerability 8.6 High
- amd athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 4004 series processors, epyc™ 7002 series processors +59 more +61 more Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could... 7.1 High
- openclaw OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes 9.1 Critical
- openclaw OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation 9.0 Critical
- openclaw OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession 6.1 Medium
- openclaw OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope 8.7 High
- openclaw OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect 8.5 High
- openclaw OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim 8.7 High
- openclaw OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation 8.7 High
- cisco catalyst sd-wan manager, catalyst sd-wan manger +1 more Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability 5.4 Medium
- cisco catalyst sd-wan manager Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability 8.8 High
- apache airflow Apache Airflow: Airflow externalLogUrl Permission Bypass 6.5 Medium
- nomysoft informatics nomysem Improper Authorization in Nomysoft Informatics' Nomysem 7.1 High
- alteryx server When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object... 5.4 Medium
- siemens spectrum power 4 A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The... 8.5 High
- xorux lpar2rrd KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal 8.8 High
- xorux lpar2rrd KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information 5.3 Medium
- xorux lpar2rrd KL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of Service 6.5 Medium
- xorux xormon, xormon-ng +1 more KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator 5.3 Medium
- xorux xormon, xormon-ng +1 more KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information 5.3 Medium
- beamsec phishpro Privilege Escalation in Beamsec PhishPro 8.8 High
- digiwin eai Digiwin｜EAI - Privilege Escalation 8.7 High
- dell powerprotect data manager Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of... 7.8 High
- opentext™ operations bridge manager, operations bridge suite (containerized), ucmdb ( classic and containerized) +2 more Incorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product. 8.7 High
- sechard information technologies sechard Authentication Bypass in Sechard Information Technologies' SecHard 9.0 Critical
- octopus server In affected versions of Octopus Deploy where customers are using Active Directory for... 6.9 Medium
- bentley projectwise integration server Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query... 6.4 Medium
- progress whatsup gold WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability 9.8 Critical
- d-link dsl6740c, dlink dsl6740c firmware +1 more D-Link DSL6740C - Incorrect Use of Privileged APIs 9.8 Critical
- xwiki, xwiki xwiki-platform +1 more Missing checks for notification filter preferences editions in XWiki Platform 6.5 Medium
- linuxfoundation opendaylight The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an... 9.1 Critical
- extremepacs extreme xds Information Disclosure in ExtremePacs's Extreme XDS 7.2 High
- utarit solipay mobile, solipay mobile app +1 more Sensetive Data Exposure in Utarit's Soliclub 7.5 High
- siemens unicam fx A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used... 7.8 High
- eskom computer e-municipality module, eskom e-belediye +1 more Information Disclosure in Eskom E-municipality 7.5 High
- eskom computer e-municipality module, eskom e-belediye +1 more Information Disclosure in Eskom E-municipality 7.5 High
- yepas digital yepas Information Disclosure in Digital Yepas 9.8 Critical
- mongodb inc. ops manager, mongodb ops manager server +1 more Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager 7.2 High
- cisco secure workload A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote... 4.3 Medium
- xwiki, xwiki xwiki-platform +1 more org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors 9.1 Critical
- dell powerprotect data manager, ppdm reporting (powerprotect data manager) +1 more Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A... 8.8 High
- cisco identity services engine, identity services engine software +1 more A vulnerability in the web-based management interface of Cisco Identity Services Engine could... 4.3 Medium
- usememos memos, usememos/memos +1 more Incorrect Use of Privileged APIs in usememos/memos 7.3 High
- usememos memos, usememos/memos +1 more Incorrect Use of Privileged APIs in usememos/memos 8.1 High
- Show olderLoading…