Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,052 results · Feed
-
Medium 5.5
Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and export…
-
Medium 6.2
Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath…
-
High 7.8
In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM p…
-
High 7.2
IRISPowerscan Insecure default privilege assignment for installation account
IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predictable password, which could allow an unauthenticated attacker to gain unauthorised access to privileged application fu…
-
High 7.8
CVE-2026-16305
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `exec…
-
High 7.1
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerabili…
-
High 7.8CVE-2026-114148 Public exploit
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 7.5
Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attac…
-
High 7.8
GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation
GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group.…
-
Medium —
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask…
-
High 7.8
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and …
-
High 7.8
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plug…
-
High 7.3
WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows …
-
Medium 5.5
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues)…
-
High 7.8
Incorrect Default Permissions in hMailServer
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions …
-
Medium 5.5CVE-2026-85300 Public exploit
Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the proces…
-
Medium 5.4
Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on th…
-
High 7.8
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileg…
-
High 7.5
Windows Server Update Service Elevation of Privilege Vulnerability
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash cont…
-
Low 2.1
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary ac…
-
Low 3.3
Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.
-
Medium 5.5
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to ve…
-
High 7.8
Incorrect Default Permissions in hMailServer
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailSer…
-
Medium 5.5
Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require hi…
-
High 7.1
Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.al…
-
Medium 6.2
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.
-
Medium 5.5
Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions v…
-
Medium 5.5
Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability.…
-
Medium 5.9
Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory
Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control…
-
High 7.8CVE-2026-87886 Exploited
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin…
KEV Sep 16, 2026 -
High 8.5
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privil…
-
Medium 5.5
Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins…
-
High 8.4
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FI…
-
High 7.8
A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a l…
-
Critical 9.1
YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorizati…
-
High 8.8
Inductive Automation Ignition Incorrect Default Permissions
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no…
-
High 7.8
PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to exec…
-
High 8.8
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service …
-
High 7.0
Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to …