Common Weakness Enumeration
CWE-268 Privilege Chaining
Description
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-268 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-hmp7-x699-cvhq | CVE-2025-32445 | CRITICAL |
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR |
2025-04-23 | |
| GHSA-mxr3-8whj-j74r | CVE-2025-32955 | MODERATE | - |
Harden-Runner allows evasion of 'disable-sudo' policy |
2025-04-22 |
| GHSA-xpff-c35g-j3cr | - | MODERATE | - |
silverstripe/framework Privilege Escalation Risk in Member Edit form |
2024-05-27 |
| GHSA-86rf-38v8-9c4x | CVE-2023-0759 | HIGH | - |
privilege chaining in cockpit-hq/cockpit |
2023-02-16 |
| GHSA-f99g-pg48-wrfc | CVE-2021-3932 | MODERATE | - |
twill is vulnerable to Cross-Site Request Forgery (CSRF) |
2021-11-17 |