# Privileged updater consumes lower-user-controlled staging content

A standard user can replace a staged file or redirect a path actually consumed by a privileged installation process.

**Candidate CWE:** [CWE-732](https://cwe.mitre.org/data/definitions/732.html) · [CWE-367](https://cwe.mitre.org/data/definitions/367.html)

## Test hypothesis

Trace a normal update, inspect the observed parent/file ACLs, then use an inert fixture to show a standard-user change reaches the privileged consumer in a disposable VM.

## Evidence required

Write permission, exact path/object, real consumer identity, timing if a race is claimed and a harmless resulting operation.

## Rule out false positives

Writable unused directories, same-user modifications, or actions requiring administrator privileges do not establish escalation.

## Playbook and command references

- [Update signatures, rollback and privileged installation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/update-integrity.html) — Test the update decision and installation boundary while preserving production signer and privilege assumptions.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Update%20signatures%2C%20rollback%20and%20privileged%20installation)

## Referenced by these target playbooks

[Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1068 · Exploitation for Privilege Escalation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1068) — **Only if:** A software vulnerability crosses a privilege boundary into a more privileged process or security context; record before/after identities and the vulnerable component. **Not established by:** Do not infer this from any feature named admin, a writable path alone, or a kernel version match. Application role authorization flaws need their own contextual analysis.

## Primary references

- [Microsoft ACL inspection](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls)
- [Apple code signing boundaries](https://developer.apple.com/library/archive/technotes/tn2206/_index.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)