Weakness (CWE)
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Source: MITRE CWE-281
100 results · Clear filters · Feed
-
Medium 5.3
OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the b…
-
Medium 6.7
Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is…
-
Medium 4.3
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
-
Medium 6.5
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-on…
-
Medium 6.9
Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher
A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those…
-
Medium 6.3
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil…
-
Medium 5.3
MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by another user even after it becomes private, bypassing read access revocation. The loss o…
-
Medium 5.7
Joplin Server delta API returns note content after share access is revoked
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, relat…
-
Medium 5.5
filemanagement_storage_service has an improper preservation of permissions vulnerability
in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak
-
Medium 6.3
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, pote…
-
Medium 4.2
uutils coreutils mv Silent Ownership Loss in Cross-Device Operations
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's …
-
Medium 6.6
uutils coreutils cp Unexpected Privileged Executable Creation with -p
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can resu…
-
Medium 4.3
Rancher user retains access to clusters despite Global Role removal
A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * …
-
Medium 4.4
In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the in…
-
Medium 5.5
Pasteboard has an improper preservation of permissions vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
-
Medium 5.5
telephony_call_manager has an improper preservation of permissions vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.
-
Medium 4.8
SystemUI component protection settings vulnerability
SystemUI has an incorrect component protection setting, which allows access to specific information.
-
Medium 4.3
Potential bypass of chat permissions in Discourse
Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some cases. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. U…
-
Medium 4.4
snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to th…
-
Medium 4.9
RuoYi vulnerable to Denial of Service by attackers with admin privileges
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.
-
Medium 5.5
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be ab…
-
Medium 6.5
An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a…
-
Medium 5.4
Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (…
-
Medium 5.4
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Suppo…
-
Medium 5.0CVE-2025-22620 Public exploit
gix-worktree-state nonexclusive checkout sets executable files world-writable
gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permis…
-
Medium 6.0
Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. S…
-
Medium 4.6
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with…
-
Medium 4.6
Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically prox…
-
Medium 5.5
The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access u…
-
Medium 5.7
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS …
-
Medium 6.5
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt commun…
-
Medium 4.6
Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.
-
Medium 6.5
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup in…
-
Medium 6.2
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change t…
-
Medium 6.5
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Se…
-
Medium 5.7
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a …
-
Medium 5.4
Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify owners…
-
Medium 4.0
The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed ap…
-
Medium 6.5
A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This v…
-
Medium 5.3
Permission bypass in M-Files Connector for Copilot
Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation