Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
467 results · Clear filters · Feed
-
High 8.3
NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|exec…
-
High 7.3
Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting …
-
High 7.3
Insecure permission assignment due to execution of LogPathConfig.exe during setup
In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2…
-
High 8.8
SurrealDB before 1.0.1 Insecure Default Table Permissions
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances…
-
High 8.5
Privilge misconfiguration in Secure Access installers
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is…
-
High 8.5
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unp…
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 8.2
Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which co…
-
High 7.8
Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious execut…
-
High 7.8
PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a D…
-
High 8.1
Warp may allow terminal output to access the local clipboard through OSC 52
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access to the local system clipboard. A malicious remote host, remote program, or other attacker-controlle…
-
High 8.8
Incorrect permissions in ArubaSign by Aruba
Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is caused by the assignment of inappropriate permissions during the software’s default installation, whereby the main executable and other programme files locate…
-
High 8.8
Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia opera…
-
High 8.5
Insecure default permissions in Portainer CE
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files o…
-
High 7.8
Local Privilege Escalation in Canonical Multipass
An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipa…
-
High 7.8
Incorrect Default Permissions in CODESYS Development System
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verifi…
-
High 7.8
Incorrect Default Permissions in CODESYS Development System
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation …
-
High 8.4
Splinterware System Scheduler Pro 5.12 Privilege Escalation
Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying service executable files. Attackers can rename the WService.exe file in the installation directory a…
-
High 8.1
Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration
Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/res…
-
High 8.5
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achie…
-
High 7.0
Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) …
-
High 7.5
ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
-
High 7.8
Local privilege escalation to SYSTEM in Cribl Edge for Windows
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory (CWE-276) expose a cryptographic s…
-
High 8.5
Local Privilege Escalation in pcvisit service client
Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local attacker to escalate their privileges by overwriting the service binary with arbitrary contents. This service binary is automatically launched with NT\SYSTEM priv…
-
High 8.2
HKUDS OpenHarness Insecure Default Remote Channel Allowlist
HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured chann…
-
High 8.8
HKUDS OpenHarness Plugin Management Command Exposure
HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely man…
-
High 7.8
SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file …
-
High 8.4
Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure
Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800
-
High 7.8
Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects Ma…
-
High 7.3
Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)
Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vu…
-
High 8.8
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.
-
High 8.4
OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files
OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets …
-
High 7.8
The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installa…
-
High 8.2
World-writable uninstall script executed as root in Arturia Software Center
When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plug…
-
High 7.8
.NET Elevation of Privilege Vulnerability
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber …
-
High 7.8
UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vu…
-
High 7.8
The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability…
-
High 7.8
vscode-spell-checker has a workspace-trust bypass Code Execution
vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted treats the configuration value cSpell.trustedWorkspace as the authoritative trust flag. The value defaults to true (pa…
-
High 8.8
Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in th…