CWE-267, Privilege Defined With Unsafe Actions, covers a privilege, role, capability, or right that can be used for unsafe actions that were not intended, even when it is assigned to the correct entity.
This is a design problem. Nobody mis-assigned anything. The privilege itself is too powerful for its name.
How it happens
A role is created for a narrow purpose, such as "report viewer" or "support agent", and then it is allowed to reach an operation far beyond that purpose. The permission is reasonable on paper and dangerous in effect.
MITRE's observed examples show the variety:
- CVE-2002-1981 (Gold): roles have access to dangerous procedures.
- CVE-2002-1671 (Gold): an untrusted object or method gets access to the clipboard.
- CVE-2004-2204 (Gold): users gain privileges using functions or tags that should be restricted.
- CVE-2000-0315 (Gold): the traceroute program lets unprivileged users modify the source address of a packet.
What an attacker gains
MITRE lists gaining privileges or assuming identity. A user can reach restricted functionality and sensitive information, possibly including administrative functions and user accounts.
How to find it
- List what each role can actually call, not what its label suggests.
- Look for powerful primitives exposed to low trust roles: raw SQL procedures, scripting tags, file access, packet crafting.
- Ask of every capability: if the worst person with this right used it, what is the worst result?
How to fix it
- Define roles by the smallest set of actions that does the job.
- Remove or gate dangerous operations behind a separate, rarely granted right.
- Make dangerous capabilities opt in, not part of a default role.
- Review roles when new features add new actions, since existing roles may pick them up silently.
-- Narrow: read access only to the reporting views
GRANT SELECT ON reporting.sales_summary TO report_viewer;
-- Avoid: broad grants that include stored procedures
-- GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA admin TO report_viewer;
Quick check
How is CWE-267 different from CWE-266?
In CWE-266 the privilege goes to the wrong actor. In CWE-267 the right actor gets it, but the privilege itself allows unsafe actions.
Sources
- MITRE CWE-267: https://cwe.mitre.org/data/definitions/267.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-267
