← Back
CWE-268

22 CVEs • Abstraction: Base • Likelihood of Exploit: High

Privilege Chaining

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

JSON object

Loading...

CVEs (22)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-1003
1Mattermost
1Mattermost
Jun 17, 2026
Mar 18, 2022
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to ov...Show more
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.Show less
CVE-2019-3844
3Canonical
NetappSystemd Project
6Cn1610 Firmware
Hci Management NodeSnapprotect+3 more
Jun 17, 2026
Apr 26, 2019
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the se...Show more
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.Show less