CWE-283: Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

27 tracked CVEs are classified under this weakness.

Highest-risk vulnerabilities

• CVE-2026-26016 — Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
• CVE-2026-29788 — TSPortal: Anyone can forge self-deletion requests of any user
• CVE-2025-43882 — Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged a
• CVE-2026-4269 — Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
• CVE-2025-47940 — TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer
• CVE-2025-1007 — Improper Authorization in /user/namespace/{namespace}/details
• CVE-2026-54467 — On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 ac
• CVE-2026-44707 — Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts
• CVE-2025-9822 — Secret data extraction via elfinder
• CVE-2024-1853 — Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination
• CVE-2026-9745 — Vulnerabilities exists in IBM Netezza Software
• CVE-2026-44562 — Open WebUI: Model Import Overwrites Any Model Without Ownership Check
• CVE-2025-12815 — An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS
• CVE-2025-36091 — IBM Business Automation Insights unverified ownership
• CVE-2026-85781 — Unverified access point ownership in Amazon EFS CSI Driver
• CVE-2026-40337 — Sentry kernel has incomplete ownership check for IRQ line manipulation
• CVE-2026-84386 — A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all vers
• CVE-2026-0598 — Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api
• CVE-2026-15599 — Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner
• CVE-2024-27903 — OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Recently published

• CVE-2026-84386 — A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all vers
• CVE-2026-85781 — Unverified access point ownership in Amazon EFS CSI Driver
• CVE-2026-9745 — Vulnerabilities exists in IBM Netezza Software
• CVE-2026-54467 — On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 ac
• CVE-2026-15599 — Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner
• CVE-2026-44707 — Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts
• CVE-2026-44562 — Open WebUI: Model Import Overwrites Any Model Without Ownership Check
• CVE-2026-40337 — Sentry kernel has incomplete ownership check for IRQ line manipulation
• CVE-2026-4269 — Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
• CVE-2026-29788 — TSPortal: Anyone can forge self-deletion requests of any user
• CVE-2026-26016 — Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
• CVE-2026-0598 — Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api
• CVE-2025-12815 — An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS
• CVE-2025-36091 — IBM Business Automation Insights unverified ownership
• CVE-2025-9822 — Secret data extraction via elfinder
• CVE-2025-43882 — Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged a
• CVE-2025-47940 — TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer
• CVE-2025-1007 — Improper Authorization in /user/namespace/{namespace}/details
• CVE-2024-27903 — OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker
• CVE-2024-1853 — Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination

Browse the full CVE database