Incorrect Ownership Assignment
CWE-708
The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Policy: Periodically review the privileges and their owners.
Latest Incorrect Ownership Assignment vulnerabilities
- 8.1 High severity
homebox: Incorrect Ownership Assignment
HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the
- 7.8 High severity
Parallels Desktop for Mac: Improper Link Resolution Before File Access
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By u
- 7.5 High severity
GitLab: Incorrect Ownership Assignment
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matc
- 9.8 Critical severity
GitLab: Incorrect Ownership Assignment
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs
- 7.3 High severity
Cisco CX Cloud Agent: Incorrect Ownership Assignment
A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by persuading support to update settings w
- 7.5 High severity
OpenVPN Access Server: Insertion of Sensitive Information into Log File
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password
- 7.8 High severity
Contrail Service Orchestration: Authentication Bypass Using an Alternate Path or Channel
An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently