CWE-269 Improper Privilege Management

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

containerd CRI plugin: Checkpoint restore bypasses destination security context

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Ghost: Editors Could Promote Staff Users to Their Own Role

Backstage: Improper preservation of access restrictions during service credential delegation

wger: Trainer Privilege Escalation - Improper Privilege Management

Nx daemon and plugin worker sockets are accessible to other local users

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Withdrawn Advisory: Open WebUI Allows Admin Deletion via API Endpoint