Skip to content
OpenAdvisories

Weakness (CWE)

CWE-276: Incorrect Default Permissions

Base Draft

During installation, installed file permissions are set to allow anyone to modify those files.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    The architecture needs to access and modification attributes for files to only those users who actually require those actions.

  2. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-276

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-85300 Public exploit

    Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

    Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the proces…

    Apache Software Foundation Apache Camel
  • Medium 5.5
    CVE-2025-6264 Public exploit

    Velociraptor priviledge escalation via UpdateConfig artifact

    Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require h…

    Rapid7 Velociraptor www.velocidex.com/golang/velociraptor Go
  • Medium 6.8
    CVE-2024-50657 Public exploit

    An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCode…

  • Medium 4.3
    CVE-2024-34223 Public exploit

    Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow…

  • Medium 5.5
    CVE-2024-22889 Public exploit

    Phone information disclosure vulnerability

    Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

    plone PyPI
  • Medium 6.5
    CVE-2023-27035 Public exploit

    An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio a…

  • Medium 5.3
    CVE-2023-29923 Public exploit

    PowerJob vulnerable to Insecure Permissions

    PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.

    tech.powerjob:powerjob Maven
  • Medium 4.4
    CVE-2022-0486 Public exploit

    Privileged Command Injection Vulnerability in Fidelis Network and Deception

    Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent t…

    Fidelis Cybersecurity Fidelis Deception Fidelis Network
  • Medium 6.5
    CVE-2022-22948 Exploited Public exploit EPSS 13%

    The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…

    Virtualization
    KEV Jul 17, 2024
  • Medium 6.5
    CVE-2018-14335 Public exploit EPSS 13%

    An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read…

    h2database Ubuntu