Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,058 results · Feed
-
Critical 9.1
YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorizati…
-
High 8.8
Inductive Automation Ignition Incorrect Default Permissions
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no…
-
High 7.8
PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to exec…
-
High 8.8
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service …
-
High 7.0
Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to …
-
High 7.0
Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to…
-
Medium 6.2
openssl_encrypt before 1.4.9 Insecure File Permissions
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged l…
-
High 7.8
SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is …
-
High 7.0
Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequent…
-
High 7.5
HCL Hive is affected by incorrect default permissions
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
-
Medium 6.6
Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability
Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain t…
-
High 7.8
Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privi…
-
Low 3.1
D-Link DIR-842 vsftpd vsftpd.conf default permission
A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high co…
-
Low 3.1
TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission
A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degre…
-
High 7.8
During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Ma…
-
Medium 4.7
HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resul…
-
Medium 6.8
WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.
-
Medium 5.5
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable…
-
High 7.3
PowerShell Elevation of Privilege Vulnerability
Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
-
High 7.3
Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to…
-
High 7.3
Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to…
-
High 7.2
Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands w…
-
High 7.3
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or w…
-
High 7.8CVE-2026-39875 Public exploit
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sono…
-
High 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sono…
-
High 8.3
NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|exec…
-
High 7.3
Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting …
-
High 7.3
Insecure permission assignment due to execution of LogPathConfig.exe during setup
In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2…
-
High 8.8
SurrealDB before 1.0.1 Insecure Default Table Permissions
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances…
-
Low 2.3
SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions…
-
High 8.5
Privilge misconfiguration in Secure Access installers
CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is…
-
High 8.5
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unp…
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 8.2
Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket
Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which co…
-
Critical 9.4
WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore ful…
-
Critical 9.4
WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore ful…
-
Critical 9.4
WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore ful…
-
High 7.8
Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious execut…
-
High 7.8
PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a D…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details