Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,058 results · Feed
-
High 7.8
Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a lo…
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Cursor
The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is …
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Nozbe
The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is l…
-
Medium 4.8
TCC Bypass via misconfigured Node fuses in Mosh-Pro
The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions. Acquired resource acces…
-
High 7.8
An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate pr…
-
Medium 6.7
Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated us…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may…
-
Medium 6.7
Incorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticate…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to …
-
Medium 4.8
TCC Bypass via Inherited Permissions in Bundled Interpreter in GIMP.app
MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary command…
-
Medium 6.4
Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…
-
Medium 6.5
4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.
-
Medium 5.5
CODESYS Toolkit Exposes Sensitive Files via Default Permissions
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
-
High 8.6
Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918…
-
High 7.8
Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 all…
-
Medium 5.1
Permissions bypass vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56
CVE-2025-49082 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperl…
-
Medium 5.1
Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56
CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperl…
-
Medium 5.3
Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56
CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low, attack requirements …
-
High 7.5
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
-
High 7.1CVE-2025-45467 Public exploit
Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Eth…
-
High 7.8
Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client
During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbit…
-
Critical 9.8
Incorrect URL stripping in CSP reports
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13…
-
Medium 4.4
melange creates SBOM files in APKs with world-writable permissions
melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tampe…
-
High 7.0
apko has incorrect permission (0666) in /etc/ld.so.cache and other files
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contai…
-
High 7.8CVE-2025-0886 Public exploit
An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, auth…
-
High 8.8
A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024…
-
Medium 4.3
Stored-XSS possibility in Namo CrossEditor4
The improper default setting in JiranSoft CrossEditor4 on Windows, Linux, Unix (API modules) potentaily allows Stored XSS. This issue affects CrossEditor4: from 4.0.0.01 before 4.6.0.23.
-
High 7.3
LPE on Multipass for macOS
In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.
-
Medium 6.5
Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
-
High 8.8
Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named …
-
Low 3.2
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writ…
-
Critical 9.8
pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered th…
-
Medium 5.5
File Browser has Insecure File Permissions
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the a…
-
Medium 6.1
A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker t…
-
High 7.3CVE-2025-49144 Public exploit
Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path
Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable searc…
-
Medium 4.8
TCC Bypass via Dylib Injection in Postbox
The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker wit…
-
Medium 4.8
TCC Bypass via Dylib Injection in Phoenix Code
The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacke…
-
Medium 5.5CVE-2025-6264 Public exploit
Velociraptor priviledge escalation via UpdateConfig artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require h…
-
Low 2.7
conda-smithy Has Incorrect Default File Permissions
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions excee…
-
Low 1.0
conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker container executes commands without specifying a user. By default, Docker containers run as the root u…