Base weakness
Incomplete
CWE-273: Improper Check for Dropped Privileges
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
20
Recorded CVEs
With this primary weakness
1
KEVs
In the CISA KEV catalog
Medium
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
If the drop fails, the product will continue to run with the raised privileges, which might provide additional access to unprivileged users.
Background
In Windows based environments that have access control, impersonation is used so that access checks can be performed on a client identity by a server with higher privileges. By impersonating the client, the server is restricted to client-level security -- although in different threads it may have much higher privileges.