Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
411 results · Clear filters · Feed
-
Medium 5.5
Libvirt: information disclosure via world-readable vm snapshots
A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
-
Medium 6.6
An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during …
-
Medium 6.7
Incorrect default permissions for some Intel(R) Thread Director Visualizer software before version 1.1.1 within Ring 3:…
-
Medium 6.7
Incorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may al…
-
Medium 6.7
Incorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 wi…
-
Medium 6.7
Incorrect default permissions for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: Us…
-
Medium 6.9
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-contr…
-
Medium 6.5
A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 a…
-
Medium 5.3
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iO…
-
Medium 6.2
An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information vi…
-
Medium 6.4
Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions
A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute c…
-
Medium 6.4
Amq: privilege escalation via excessive /etc/passwd permissions
A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an aff…
-
Medium 6.9
Do permission checking when getting counts of global and local edits, new articles and thanks
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Med…
-
Medium 6.9
Insufficient permission checks in action=growthsetmentor
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
-
Medium 5.3
Newforma Info Exchange (NIX) default anonymous access
Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.
-
Medium 5.3
Excess Permissions in Warehouse
CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attac…
-
Medium 6.4
Openshift-ai: privilege escalation via excessive /etc/passwd permissions
A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands withi…
-
Medium 5.5
BMC Control-M/Agent insecure default file permissions
Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These file…
-
Medium 5.1
In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could l…
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Cursor
The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is …
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Nozbe
The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is l…
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Mosh-Pro
The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions. Acquired resource acces…
-
Medium 6.7
Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated us…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may…
-
Medium 6.7
Incorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticate…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to …
-
Medium 4.8
TCC Bypass via Inherited Permissions in Bundled Interpreter in GIMP.app
MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary command…
-
Medium 6.4
Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…
-
Medium 6.5
4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.
-
Medium 5.5
CODESYS Toolkit Exposes Sensitive Files via Default Permissions
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
-
Medium 5.1
Permissions bypass vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56
CVE-2025-49082 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperl…
-
Medium 5.1
Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56
CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperl…
-
Medium 5.3
Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56
CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low, attack requirements …
-
Medium 4.4
melange creates SBOM files in APKs with world-writable permissions
melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tampe…
-
Medium 4.3
Stored-XSS possibility in Namo CrossEditor4
The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: from 4.0.0.01 before 4.6.0.23.
-
Medium 6.5
Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
-
Medium 5.5
File Browser has Insecure File Permissions
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the a…
-
Medium 6.1
A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker t…
-
Medium 4.8
TCC Bypass via Dylib Injection in Postbox
The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker wit…
-
Medium 4.8
TCC Bypass via Dylib Injection in Phoenix Code
The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacke…