CWE-270, Privilege Context Switching Error, is a product that does not properly manage privileges while switching between contexts with different privileges or spheres of control.
Any system with more than one trust level can suffer from it: browsers with security zones, servers handling requests for different users, applications running callbacks.
How it happens
A context switch is a moment when the identity or trust level should change, and the code must change it completely. If the old privileges linger, or the new ones arrive early, an actor ends up in the wrong place.
MITRE's examples:
- CVE-2002-1688 (Gold) and CVE-2003-1026 (Gold): web browser cross domain problems when the user hits the back button.
- CVE-2002-1770 (Gold): a third party product passes code to a web browser, which executes it in an unsafe zone.
- CVE-2005-2263 (Gold): a callback runs in a different security context after it has been changed from untrusted to trusted. MITRE adds that "context switch before actions are completed" is a type of problem that happens frequently.
What an attacker gains
MITRE lists gaining privileges or assuming identity. A user can take on the identity of another user with different privileges in another context, which can expose that user's access information.
How to find it
- List every point where the program changes identity, role, tenant, zone, or thread.
- Check what state carries over: credentials, session data, cached authorization decisions.
- Test sequences, not single actions: navigate back, retry, cancel halfway, replay a callback.
How to fix it
- Treat each switch as a full reset. Re-derive the privileges for the new context rather than inheriting them.
- Finish or abort pending actions before switching.
- Bind callbacks to the context in which they were registered and check it again when they run.
- Avoid caching authorization decisions across contexts.
Quick check
What is a context switch in this sense?
Any point where execution moves between identities or trust levels, such as a browser moving from one security zone to another or a callback running under a different user.
Sources
- MITRE CWE-270: https://cwe.mitre.org/data/definitions/270.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-270
