Weakness (CWE)
CWE-277: Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-277
44 results · Clear filters · Feed
-
Medium 6.3
Privilege escalation via unprotected Windows agent data folder
Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) allow a local user to execute arbitrary code …
-
Medium 5.5
Podman: arbitrary file write when importing oci archive
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
-
Medium 6.5
view_component: Preview Route Can Dispatch Inherited Helper Methods
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requ…
-
Medium 4.3
OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions
OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, child-count limits, control scope, or target-agent restrictions. Attackers can exploit…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.4, macOS Sono…
-
Medium 6.7
Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Appl…
-
Medium 6.9
Open OnDemand RPM packages create world writable locations
Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
-
Medium 6.7
Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application before version 20.0.1021 within R…
-
Medium 6.3CVE-2025-11554 Public exploit
Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insec…
-
Medium 6.5CVE-2025-56019 Public exploit
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobi…
-
Medium 4.3
Information Disclosure in Amazon ECS Container Agent
We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that …
-
Medium 6.5
IBM Storage Scale information disclosure
IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.
-
Medium 6.0
Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution
Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access …
-
Medium 6.7
IBM Security Guardium privilege escalation
IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program.
-
Medium 5.1
django-helpdesk Allows Sensitive Data Exposure
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.
-
Medium 6.1
Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an …
-
Medium 6.7
Insecure inherited permissions in the NVM Update Utility for some Intel(R) Ethernet Network Adapter E810 Series before …
-
Medium 6.6
Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity a…
-
Medium 6.8
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. A low …
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS B…
-
Medium 6.7
IBM Robotic Process Automation privilege escalation
IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can sub…
-
Medium 6.7
Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user …
-
Medium 6.7
Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user …
-
Medium 6.7
Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow a…
-
Medium 6.7
Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may …
-
Medium 6.7
Pulpcore: rbac permissions incorrectly assigned in tasks that create objects
A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object cre…
-
Medium 6.3
Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arb…
-
Medium 6.7
Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated us…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user t…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated u…
-
Medium 6.7
Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software…
-
Medium 4.1
Overly Permissive Access Policy
The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.
-
Medium 6.7
Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may al…
-
Medium 6.7
Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticat…
-
Medium 6.7
Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow a…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user t…
-
Medium 6.7
Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow…
-
Medium 6.7
Insecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticate…