Incorrect Use of Privileged APIs
CWE-648
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
When a product contains certain functions that perform operations requiring an elevated level of privilege, the caller of a privileged API must be careful to: ensure that assumptions made by the APIs are valid, such as validity of arguments account for known weaknesses in the design/implementation of the API call the API from a safe context If the caller of the API does not follow these requirements, then it may allow a malicious user or process to elevate their privilege, hijack the process, or steal sensitive data. For instance, it is important to know if privileged APIs do not shed their privileges before returning to the caller or if the privileged function might make certain assumptions about the data, context or state information passed to it by the caller. It is important to always know when and how privileged APIs can be called in order to ensure that their elevated level of privilege cannot be exploited.
We track 40 vulnerabilities of this type. 98% are rated high or critical, and the average CVSS score is 8.2. 2 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Before calling privileged APIs, always ensure that the assumptions made by the privileged code hold true prior to making the call.
- Architecture and Design: Know architecture and implementation weaknesses of the privileged APIs and make sure to account for these weaknesses before calling the privileged APIs to ensure that they can be called safely.
- Implementation: If privileged APIs make certain assumptions about data, context or state validity that are passed by the caller, the calling code must ensure that these assumptions have been validated prior to making the call.
- Implementation: If privileged APIs do not shed their privilege prior to returning to the calling code, then calling code needs to shed these privileges immediately and safely right after the call to the privileged APIs. In particular, the calling code needs to ensure that a privileged thread of execution will never be returned to the user or made available to user-controlled processes.
- Implementation: Only call privileged APIs from safe, consistent and expected state.
Latest Incorrect Use of Privileged APIs vulnerabilities
- 7.8 High severity
ghostpdl: Incorrect Use of Privileged APIs
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trig
- 7.3 High severity
Red Hat Enterprise Linux 8: Incorrect Use of Privileged APIs
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected.
- 10.0 Critical severity
Cisco Identity Services Engine Incorrect Use of Privileged APIs Exploited
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vuln
- 8.8 High severity
Anchore Enterprise: Incorrect Use of Privileged APIs
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifyi
- 8.4 High severity
Parsec: Incorrect Use of Privileged APIs
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a s
- 7.5 High severity
Access Manager: Incorrect Use of Privileged APIs
An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.
- 7.8 High severity
OpenVPN Connect: Improper Neutralization of Special Elements used in an OS Command
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
- 9.1 Critical severity
BIG-IP: Incorrect Use of Privileged APIs
A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support
- 9.8 Critical severity
OpenClaw: Incorrect Use of Privileged APIs
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their
- 9.9 Critical severity
OpenClaw: Incorrect Use of Privileged APIs
OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restrict
- 7.5 High severity
AMD EPYC™ 9004 Series Processors: Exposure of Resource to Wrong Sphere
Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.
- 8.8 High severity
OpenClaw: Incorrect Use of Privileged APIs
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain
- 8.8 High severity
OpenClaw: Incorrect Use of Privileged APIs
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unauthorized adminis
- 8.8 High severity
OpenClaw: Incorrect Authorization
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a reque
- 8.8 High severity
OpenClaw: Incorrect Use of Privileged APIs
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can e
- 7.8 High severity
OpenClaw: Incorrect Use of Privileged APIs
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by trigge
- 7.8 High severity
Cisco Catalyst SD-WAN Manager: Incorrect Use of Privileged APIs
A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST
- 5.4 Medium severity
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Exploited
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access o
- 7.1 High severity
Nomysem: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.
- 7.8 High severity
Spectrum Power 4: Incorrect Use of Privileged APIs
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to an exposed debug interface on the localhost. This allows any local user to gain code exe
- 8.8 High severity
LPAR2RRD: Path Traversal: '../filedir'
An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (
- 8.8 High severity
EAI: Incorrect Use of Privileged APIs
The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a specific API.
- 7.8 High severity
PowerProtect Data Manager: Incorrect Use of Privileged APIs
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- 8.7 High severity
Operations Bridge Manager: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Classic and Containerized) allows Privilege Escalation. The vulnerability could allow authenticated atta
- 9.0 Critical severity
SecHard: Cleartext Transmission of Sensitive Information
Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harves
- 9.8 Critical severity
DSL6740C: Incorrect Use of Privileged APIs
The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user’s account.
- 9.1 Critical severity
opendaylight: Incorrect Use of Privileged APIs
The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.
- 7.2 High severity
Extreme XDS: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3914.
- 7.5 High severity
SoliPay Mobile App: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users. This issue affects SoliPay Mobile App: before 5.0.8.
- 7.8 High severity
Unicam FX: Incorrect Use of Privileged APIs
A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host (conhost.exe) as a child process with SYSTEM privileges. This
- 7.5 High severity
e-municipality module: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105.
- 7.5 High severity
e-municipality module: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users. This issue affects e-municipality module: before v.105.
- 9.8 Critical severity
Digital Yepas: Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1.
- 7.2 High severity
MongoDB Ops Manager: Improper Privilege Management
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
- 7.2 High severity
xwiki-platform: Incorrect Use of Privileged APIs
XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts sinc
- 8.8 High severity
PPDM Reporting (PowerProtect Data Manager): Incorrect Use of Privileged APIs
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to bypass intended access restrictions and perform unauthorized
- 8.8 High severity
Cisco Identity Services Engine Software: Incorrect Use of Privileged APIs
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access system files. This vulnerability is due to improper access control in the web-based m
- 8.2 High severity
PingID Windows Login: Improper Privilege Management
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically
- 8.1 High severity
xwiki-platform: Incorrect Use of Privileged APIs
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that ar
- 7.1 High severity
NAVER Whale browser: Incorrect Use of Privileged APIs
The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.