CWE-271Privilege Dropping / Lowering Errors

Abstraction: Class · CVEs in our corpus: 12

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

In some contexts, a system executing with elevated permissions will hand off a process/file/etc. to another process or user. If the privileges of an entity are not reduced, then elevated privileges are spread throughout a system and possibly to an attacker.

Last updated: 15 October 2026 14:21 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PS-5 Personnel Transfer

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`PS-5`	Personnel Transfer	PS	Mandates lowering or adjusting privileges to match new operational needs, reducing errors in privilege dropping during transfers.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2026-44477`	7.0	9.9	0.0052	2026-05-28
`CVE-2019-11243`	6.4	8.1	0.0149	2019-04-22
`CVE-2024-0985`	6.4	8.0	0.0181	2024-02-08
`CVE-2023-22648`	6.1	8.0	0.0045	2023-06-01
`CVE-2022-3569`	6.0	7.8	0.0077	2022-10-17
`CVE-2025-23395`	5.7	7.8	0.0021	2025-05-26
`CVE-2025-53819`	5.4	7.9	0.0015	2025-07-14
`CVE-2026-35535`	5.4	7.4	0.0017	2026-04-03
`CVE-2024-35179`	5.2	6.8	0.0062	2024-05-15
`CVE-2023-38496`	4.7	6.1	0.0026	2023-07-25
`CVE-2020-35513`	4.3	4.9	0.0135	2021-01-26