CWE-274Improper Handling of Insufficient Privileges

Abstraction: Base · CVEs in our corpus: 42

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 2 framework(s): STIG oracle linux 9 2 (partial) · STIG rhel 9 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.AA-05
AC-3 Access Enforcement
AC-6 Least Privilege
AC-24 Access Control Decisions

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

5 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-29365`	7.3	9.8	0.0050	2025-08-22
`CVE-2025-20156`	7.2	9.9	0.0120	2025-01-22
`CVE-2024-0105`	6.2	8.9	0.0027	2024-11-01
`CVE-2020-7264`	6.1	8.8	0.0026	2020-05-08
`CVE-2020-7265`	6.1	8.8	0.0026	2020-05-08
`CVE-2020-7266`	6.1	8.8	0.0026	2020-05-08
`CVE-2020-7267`	6.1	8.8	0.0026	2020-05-08
`CVE-2023-35928`	6.1	8.4	0.0098	2023-06-23
`CVE-2024-21648`	6.1	8.0	0.0051	2024-01-09
`CVE-2022-45101`	5.9	7.3	0.0082	2023-02-01
`CVE-2023-39375`	5.9	7.5	0.0062	2023-09-27
`CVE-2024-0106`	5.9	8.7	0.0017	2024-11-01
`CVE-2020-24676`	5.8	7.8	0.0041	2020-12-22
`CVE-2021-35534`	5.8	7.2	0.0167	2021-11-18
`CVE-2024-46974`	5.6	7.8	0.0015	2025-01-31
`CVE-2020-7289`	5.5	7.8	0.0034	2020-05-08
`CVE-2020-7283`	5.5	7.5	0.0062	2020-07-03
`CVE-2024-41942`	5.5	7.2	0.0059	2024-08-08
`CVE-2020-7285`	5.4	7.8	0.0025	2020-05-08
`CVE-2020-7286`	5.4	7.8	0.0025	2020-05-08
`CVE-2020-7287`	5.4	7.8	0.0025	2020-05-08
`CVE-2020-7288`	5.4	7.8	0.0025	2020-05-08
`CVE-2020-7290`	5.4	7.8	0.0025	2020-05-08
`CVE-2020-7291`	5.4	7.8	0.0025	2020-05-08
`CVE-2022-23511`	5.2	7.1	0.0048	2022-12-12