Cyber Posture

CWE · MITRE source

CWE-272Least Privilege Violation

Abstraction: Base · CVEs in our corpus: 25

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (12)AI

Showing the 10 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-1Policy and ProceduresACReview and update requirements help detect and correct least privilege violations in practice.
AC-13Supervision and Review — Access ControlACAccess reviews verify and enforce adherence to least privilege by identifying excess permissions.
AC-2Account ManagementACRequiring specification of intended system usage and access authorizations, plus periodic reviews, supports enforcement of least privilege.
PS-7External Personnel SecurityPSEnforces least-privilege principles for externals via role/responsibility definitions, transfer/termination notifications, and ongoing compliance checks.
PS-8Personnel SanctionsPSDirectly addresses least-privilege violations by providing a deterrent and notification mechanism when policies are not followed.
PS-9Position DescriptionsPSIncorporating least-privilege expectations into every position description makes violations of the principle harder to occur by default.
CM-7Least FunctionalityCMEnforcing only the minimal set of functionality implements least privilege by eliminating unneeded capabilities that could be abused.
PL-4Rules of BehaviorPLThe control mandates acknowledgment of least-privilege expectations, making violations by authorized users less likely.
PM-29Risk Management Program Leadership RolesPMRisk Executive role ensures least privilege is applied uniformly rather than left to individual system owners or projects.
SA-14Criticality AnalysisSACriticality analysis supplies the information needed to enforce least privilege on the most important system elements, making violations of that principle less likely to exist in high-value targets.
Show 2 more broadly-applicable controls
AC-5Separation of DutiesACSeparation of duties is a direct mechanism to enforce least privilege by ensuring no individual receives more access than required for their isolated responsibilities.
AC-6Least PrivilegeACEnforces the least privilege principle to avoid violations of minimal necessary access.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-248302.09.90.00122024-02-08
CVE-2021-267261.88.80.01082022-02-16
CVE-2024-251061.89.10.00082024-02-08
CVE-2024-288241.88.80.00092024-03-22
CVE-2025-77221.88.80.00082025-07-23
CVE-2025-591061.88.80.00092026-01-26
CVE-2024-352041.78.40.00022024-05-14
CVE-2024-559541.78.70.00122025-01-16
CVE-2024-06381.68.20.00062024-03-22
CVE-2024-271651.67.80.00072024-06-14
CVE-2024-288291.67.80.00082024-08-20
CVE-2025-478091.68.20.00072025-05-16
CVE-2025-97111.67.80.00012026-02-03
CVE-2023-280471.57.30.00092023-04-20
CVE-2023-324511.57.30.00032024-02-06
CVE-2025-491441.57.30.00102025-06-23
CVE-2025-81811.57.20.00472025-07-26
CVE-2025-13841.47.00.00072025-07-14
CVE-2025-87571.47.00.00022025-08-09
CVE-2025-87581.47.00.00022025-08-09
CVE-2023-280461.36.60.00102023-04-06
CVE-2024-07981.36.50.00132024-02-26
CVE-2025-682671.36.50.00022025-12-16
CVE-2026-326551.15.30.00012026-04-27
CVE-2026-236340.00.00.00012026-01-16