CWE-269 Improper Privilege Management

Coverage: 30 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 18Other-pattern 12 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged code where privileges/roles are assigned, escalated, or checked incorrectly (for example: users can set their own role, admin flags are client-controlled, or privilege boundaries aren't enforced consistently).

Why it matters

Improper privilege handling can grant admin access.

• Privilege escalation: users become admins or gain elevated capabilities.
• Persistence: once elevated privileges are stored, the impact persists until corrected.
• High blast radius: privileged accounts can access/export/modify everything.

Safer examples

1) Make privilege changes admin-only

Separate "self update" from "admin update" endpoints and require re-auth/MFA for privilege changes.

2) Never trust client-controlled privilege fields

Ignore client-sent role, isAdmin, permissions fields in normal user flows (see API01).

3) Apply least privilege by default

New accounts should start with the minimum permissions and require explicit elevation.

How SiteShadow detects it (high level)

• Flags client-controlled privilege fields flowing into persistence or auth decisions.
• Looks for admin-only operations without strong guards.

References

• CWE-269: https://cwe.mitre.org/data/definitions/269.html

---

← Back to Vulnerability Library