CVE-2023-50446

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mullvad/mullvadvpn-app/pull/5398Patch, Vendor Advisory
https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6Release Notes
https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6-beta1Release Notes
https://github.com/mullvad/mullvadvpn-app/pull/5398Patch, Vendor Advisory
https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6Release Notes
https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6-beta1Release Notes

Timeline

Published: Dec 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-504478.1Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2 CVE-2023-504486.5In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belon CVE-2023-504497.5JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.CVE-2023-50459.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL In CVE-2023-504508.4An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated pr CVE-2023-504535.3An issue was discovered in Zammad before 6.2.0. It uses the public endpoint /api/v1/signshow for its login screen. This endpoint returns int CVE-2023-504545.9An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services withou CVE-2023-504557.5An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could CVE-2023-504565.3An issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first CVE-2023-504574.3An issue was discovered in Zammad before 6.2.0. When listing tickets linked to a knowledge base answer, or knowledge base answers of a ticke CVE-2023-504584.3In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.CVE-2023-504595.4An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user compon