CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN executable with a malicious one. When a higher privileged user such as an Administrator launches that executable, it is possible for the lower privileged user to escalate to Administrator privileges.

• CWE-732

• https://www.tenable.com/security/research/tra-2021-58Patch, Third Party Advisory
• https://www.tenable.com/security/research/tra-2021-58Patch, Third Party Advisory

Published

Dec 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44460Improper access control in Odoo Community 13.0 and earlier a…6.5
• CVE-2021-44461Cross-site scripting (XSS) issue in Accounting app of Odoo E…6.1
• CVE-2021-44462This vulnerability can be exploited by parsing maliciously c…7.1
• CVE-2021-44463Missing DLLs, if replaced by an insider, could allow an atta…7.3
• CVE-2021-44464Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.…8.8
• CVE-2021-44465Improper access control in Odoo Community 13.0 and earlier a…4.3
• CVE-2021-44467A broken access control vulnerability in the KillDupUsr_func…7.5
• CVE-2021-4447The Essential Addons for Elementor plugin for WordPress is …8.8
• CVE-2021-44470Incorrect default permissions for the Intel(R) Connect M And…5.5
• CVE-2021-44471DIAEnergie Version 1.7.5 and prior is vulnerable to stored c…6.1
• CVE-2021-44476A sandboxing issue in Odoo Community 15.0 and earlier and Od…6.8
• CVE-2021-44477GE Gas Power ToolBoxST Version v04.07.05C suffers from an XM…7.5