CWE-648 Incorrect Use of Privileged APIs
Description
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-648 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-pm44-x5x7-24c4 | CVE-2026-22922 | MODERATE |
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access |
2026-06-05 | |
| GHSA-gg9v-mgcp-v6m7 | CVE-2026-41386 | HIGH |
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing |
2026-05-06 | |
| GHSA-h4jx-hjr3-fhgc | CVE-2026-35645 | MODERATE |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` |
2026-04-18 | |
| GHSA-m5jp-p3r5-mfqp | - | MODERATE |
Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` |
2026-04-18 | |
| GHSA-r3v5-2grc-429h | - | HIGH |
Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve |
2026-04-10 | |
| GHSA-pwfv-3cvg-9m4c | CVE-2023-29507 | CRITICAL |
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors |
2025-02-06 | |
| GHSA-r95w-889q-x2gx | CVE-2024-46978 | HIGH |
org.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions |
2024-11-18 | |
| GHSA-ghx2-6v4g-9wmm | CVE-2022-4796 | HIGH |
usememos/memos makes Incorrect Use of Privileged APIs |
2023-01-10 | |
| GHSA-mq5q-gpgv-pwxw | CVE-2022-4805 | MODERATE |
usememos/memos Incorrect Use of Privileged APIs vulnerability |
2023-01-10 | |
| GHSA-fv6c-rfg3-gvjw | CVE-2022-4687 | HIGH |
usememos/memos makes Incorrect Use of Privileged APIs |
2023-01-02 | |
| GHSA-ghcq-472w-vf4h | CVE-2022-24821 | MODERATE |
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx |
2022-04-08 |