Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,058 results · Feed
-
Critical 9.8
ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits
Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHan…
-
High 7.8
Local Privilege Escalation
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.
-
Low 2.8
An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unaut…
-
Critical 9.9
A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contai…
-
High 8.2
Wasp has case insensitive OAuth ID vulnerability
Wasp (Web Application Specification) is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation (affecting only Keycloak with a specific config). Wasp c…
-
Medium 6.7
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect…
-
Medium 5.8
MaxKB Python Sandbox Bypass in Function Library
MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution …
-
High 7.3
Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with S…
-
High 7.8
An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile process…
-
High 7.8CVE-2025-2502 Public exploit
An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to el…
-
Medium 5.5
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macO…
-
Medium 4.8
TCC Bypass via Dylib Substitution in DaVinci Resolve
Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altere…
-
Medium 4.0
Insecure file permissions can result in confidential information leakage
In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
-
Medium 4.8
TCC Bypass via Dylib Loading in Viscosity.app
On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library with Viscosity's TCC (Transparency, Consent, and Control) identity. The acquired resource access is l…
-
Medium 5.0
Screen creates by default world-writable PTYs
The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system.
-
High 7.3
Insecure Permissions
Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
-
High 7.8
MSP360 Backup (for Windows) insecure filesystem permissions
An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (releas…
-
Medium 4.8
TCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.app
MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary comma…
-
Low 3.5
Plane has insecure permissions in UserSerializer
Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another …
-
High 8.2
Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authentica…
-
Medium 6.7
Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to pot…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Graphics Driver installers may allow an authenticated user to potential…
-
Medium 6.7
Incorrect Default Permissions for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticate…
-
High 8.7CVE-2025-4660 Public exploit
Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access
A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based a…
-
High 7.3
Incorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, pot…
-
High 7.3
A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, pot…
-
High 7.3
A DLL hijacking vulnerability in the AMD Optimizing CPU Libraries could allow an attacker to achieve privilege escalati…
-
High 7.3
Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker…
-
High 8.2
Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry
A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate t…
-
High 7.8
MSP360 Backup (for Linux) insecure filesystem permissions
An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).
-
High 7.8
Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when ins…
-
High 7.1
NETSCOUT nGeniusONE before 6.4.0 b2350 allows local users to leverage Insecure Permissions for the nGeniusCLI File.
-
High 7.8
Local Priviledge Escalation
When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-def…
-
High 7.5
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are aff…
-
High 7.3
Vulnerability in the RAS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19…
-
High 8.5
Local Privilege Escalation in ThinManager®
A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If e…
-
High 7.8
gerbera: Privilege escalation from user gerbera to root because of insecure %post script
A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before 2.5.0-1.1.
-
High 7.8
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Incorrect default permissions in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe per…
-
High 7.8
An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via …