Skip to content
OpenAdvisories

Weakness (CWE)

CWE-277: Insecure Inherited Permissions

Variant Draft

A product defines a set of insecure permissions that are inherited by objects that are created by the program.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-277

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-11554 Public exploit

    Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

    A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insec…

    Portabilis i-Educar
  • Medium 6.5
    CVE-2025-56019 Public exploit

    An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobi…

  • Critical 9.8
    CVE-2024-36539 Public exploit

    Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining …

  • High 8.4
    CVE-2024-34329 Public exploit

    Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch a…

  • High 7.4
    CVE-2024-27822 Public exploit

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to…

    Apple macOS macOS
  • High 8.8
    CVE-2023-27842 Public exploit

    Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…

    extplorer Ubuntu