CWE-267Base1 in KEV

Privilege Defined With Unsafe Actions

Incomplete in the CWE catalog · 72 CVEs mapped

72
CVEs mapped
1
In KEV
7.4
Median CVSS
What it is

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

Recent examples
—none
CVE-2026-96363

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

no explanation yet
—
epss
—none
CVE-2026-96367

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

no explanation yet
—
epss
—none
CVE-2026-96371

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

no explanation yet
—
epss
The record
Technical detail
CWE ID
CWE-267
Abstraction
Base
Structure
Simple
Status
Incomplete
References (1)
https://web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/least-privilege