CWE-282Class1 in KEV

Improper Ownership Management

Draft in the CWE catalog · 28 CVEs mapped

28
CVEs mapped
1
In KEV
6.3
Median CVSS
What it is

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

Recent examples
8.8cvss
CVE-2026-50130

Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

HIGHno explanation yet
0%
epss
6.3cvss
CVE-2026-40214

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

MEDIUMno explanation yet
0%
epss
6.0cvss
CVE-2026-3867

An improper ownership management vulnerability has been identified in Moxa’s Secure Router

An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. Exploitation is only possible under a specific condition — when the configuration file has been exported. This vulnerability does not impact the integrity or availability of the affected product, and no confidentiality, integrity, or availability impact to the subsequent system has been identified.

MEDIUMno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-282
Abstraction
Class
Structure
Simple
Status
Draft