CVE-2023-0834

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
HYPR	Workforce Access	>= 6.12, < 8.1

References

https://www.hypr.com/security-advisoriesVendor Advisory
https://www.hypr.com/security-advisoriesVendor Advisory

Timeline

Published: Apr 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08358.2markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application d CVE-2023-08367.5An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.CVE-2023-08375.5An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allow CVE-2023-08383.8An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A CVE-2023-08399.8Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. CVE-2023-08405.4A vulnerability classified as problematic was found in PHPCrazy 1.1.1. This vulnerability affects unknown code of the file admin/admin.php?a CVE-2023-08418.8A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_CVE-2023-08425.3xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does CVE-2023-08444.8The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such CVE-2023-08456.5Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server an CVE-2023-08466.1Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian cou CVE-2023-08478.1The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementati