The product does not properly verify that a critical resource is owned by the proper entity.

Primary

Architecture and Design
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Gain Privileges or Assume Identity
An attacker could gain unauthorized access to system resources.

Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design
Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

This function is part of a privileged program that takes input from users with potentially lower privileges.

def killProcess(processID):os.kill(processID, signal.SIGKILL)

This code does not confirm that the process to be killed is owned by the requesting user, thus allowing an attacker to kill arbitrary processes.
This function remedies the problem by checking the owner of the process before killing it:

def killProcess(processID):
user = getCurrentUser()

#Check process owner against requesting user
if getProcessOwner(processID) == user:os.kill(processID, signal.SIGKILL)return
else:print("You cannot kill a process you don't own")return

CVE-2001-0178
Program does not verify the owner of a UNIX socket that is used for sending a password.
https://www.cve.org/CVERecord?id=CVE-2001-0178

CVE-2004-2012
Owner of special device not checked, allowing root.
https://www.cve.org/CVERecord?id=CVE-2004-2012

Unverified Ownership

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This overlaps insufficient comparison, verification errors, permissions, and privileges.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2009-12-28
updated Potential_Mitigations

CWE Content Team
MITRE
2010-06-21
updated Potential_Mitigations

CWE Content Team
MITRE
2011-03-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities