CVE-2023-20959

In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-249057848

• CWE-862
• CWE-862

• https://source.android.com/security/bulletin/2023-03-01Vendor Advisory
• https://source.android.com/security/bulletin/2023-03-01Vendor Advisory

Published

Mar 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-20953In onPrimaryClipChanged of ClipboardListener.java, there is …7.8
• CVE-2023-20954In SDP_AddAttribute of sdp_db.cc, there is a possible out of…9.8
• CVE-2023-20955In onPrepareOptionsMenu of AppInfoDashboardFragment.java, th…7.8
• CVE-2023-20956In Import of C2SurfaceSyncObj.cpp, there is a possible out o…4.4
• CVE-2023-20957In onAttach of SettingsPreferenceFragment.java, there is a p…7.8
• CVE-2023-20958In read_paint of ttcolr.c, there is a possible out of bounds…7.1
• CVE-2023-2096A vulnerability was found in SourceCodester Vehicle Service …9.8
• CVE-2023-20960In launchDeepLinkIntentToRight of SettingsHomepageActivity.j…8.8
• CVE-2023-20962In getSliceEndItem of MediaVolumePreferenceController.java, …5.5
• CVE-2023-20963In WorkSource, there is a possible parcel mismatch. This cou…7.8
• CVE-2023-20964In multiple functions of MediaSessionRecord.java, there is a…7.8
• CVE-2023-20965In processMessageImpl of ClientModeImpl.java, there is a pos…9.8