CWE-276— Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.— MITRE CWE catalog
1,759 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-276page 32 of 36
- CVE-2026-28717MEDIUMCVSS 5.0EG 5.02026-03-06
Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
- CVE-2025-46803MEDIUMCVSS 5.0EG 5.02025-05-26
The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system.
- CVE-2024-58049MEDIUMCVSS 5.0EG 5.02025-03-04
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CVE-2024-58047MEDIUMCVSS 5.0EG 5.02025-03-04
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CVE-2025-24788MEDIUMCVSS 5.0EG 5.02025-01-29
snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local dir…
- CVE-2024-39544MEDIUMCVSS 5.0EG 5.02024-10-11
An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive infor…
- CVE-2024-21615MEDIUMCVSS 5.0EG 5.02024-04-12
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system. On all Junos OS and Junos OS Evolved platforms, whe…
- CVE-2021-3722MEDIUMCVSS 5.0EG 5.02022-04-22
A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-standard locations during installation.
- CVE-2021-32006MEDIUMCVSS 5.0EG 5.02022-03-10
This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup fi…
- CVE-2011-4361MEDIUMCVSS v2 5.0EG 5.02012-01-08
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) le…
- CVE-2011-1435MEDIUMCVSS v2 5.0EG 5.02011-05-03
Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafted extension.
- CVE-2023-45690MEDIUMCVSS 4.9EG 4.92023-10-16
Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem
- CVE-2020-24402MEDIUMCVSS 4.9EG 4.92020-11-09
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to …
- CVE-2018-9085MEDIUMCVSS 4.9EG 4.92018-11-16
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platfo…
- CVE-2025-15523MEDIUMCVSS 4.8EG 4.82026-01-22
MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interprete…
- CVE-2025-9190MEDIUMCVSS 4.8EG 4.82025-08-26
The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquire…
- CVE-2025-53813MEDIUMCVSS 4.8EG 4.82025-08-26
The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquire…
- CVE-2025-53811MEDIUMCVSS 4.8EG 4.82025-08-26
The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions. A…
- CVE-2025-5963MEDIUMCVSS 4.8EG 4.82025-06-20
The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. …
- CVE-2025-5255MEDIUMCVSS 4.8EG 4.82025-06-20
The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) inject…
- CVE-2025-4081MEDIUMCVSS 4.8EG 4.82025-05-29
Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the app…
- CVE-2025-4412MEDIUMCVSS 4.8EG 4.82025-05-27
On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library with Viscosity's TCC (Transparency, Consent, and Control) identity. The acquired …
- CVE-2025-4280MEDIUMCVSS 4.8EG 4.82025-05-22
MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter…
- CVE-2024-26302MEDIUMCVSS 4.8EG 4.82024-02-27
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve informat…
- CVE-2022-3466MEDIUMCVSS 4.8EG 4.82023-09-15
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022…
- CVE-2020-5231MEDIUMCVSS 4.8EG 4.82020-01-30
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither i…
- CVE-2025-52640MEDIUMCVSS 4.7EG 4.72026-08-13
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scop…
- CVE-2024-26280MEDIUMCVSS 4.7EG 4.72024-03-01
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops…
- CVE-2021-24032MEDIUMCVSS 4.7EG 4.72021-03-04
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files co…
- CVE-2024-40514MEDIUMCVSS 4.6EG 4.62025-01-16
Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions.
- CVE-2022-20465MEDIUMCVSS 4.6EG 4.62022-11-08
In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pr…
- CVE-2013-4763MEDIUMCVSS 4.6EG 4.62019-12-27
Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission.
- CVE-2004-1778MEDIUMCVSS v2 4.6EG 4.62004-12-22
Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissions, which allows local users to modify language files and possibly conduct social engineering or o…
- CVE-2026-34450MEDIUMCVSS 4.4EG 4.42026-03-31
The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving …
- CVE-2025-64723MEDIUMCVSS 4.4EG 4.42025-12-18
Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows…
- CVE-2025-54059MEDIUMCVSS 4.4EG 4.42025-07-18
melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unpriv…
- CVE-2025-24795MEDIUMCVSS 4.4EG 4.42025-01-29
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector f…
- CVE-2025-24790MEDIUMCVSS 4.4EG 4.42025-01-29
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporar…
- CVE-2023-52954MEDIUMCVSS 4.4EG 4.42025-01-08
Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability.
- CVE-2024-46695MEDIUMCVSS 4.4EG 4.42024-09-13
In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on f…
- CVE-2024-22385MEDIUMCVSS 4.4EG 4.42024-06-25
Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific files.This issue affects Hitachi Storage Provider for VMware vCenter: from 3.1.0 before 3.7.4.
- CVE-2024-34012MEDIUMCVSS 4.4EG 4.42024-06-14
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.24135.272.
- CVE-2024-29967MEDIUMCVSS 4.4EG 4.42024-04-19
In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo …
- CVE-2024-0770MEDIUMCVSS 4.4EG 4.42024-01-21
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incor…
- CVE-2023-27392MEDIUMCVSS 4.4EG 4.42023-08-11
Incorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileged user to potentially enable information disclosure via local access.
- CVE-2023-27593MEDIUMCVSS 4.4EG 4.42023-03-17
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount o…
- CVE-2022-36367MEDIUMCVSS 4.4EG 4.42022-11-11
Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable information disclosure via local access.
- CVE-2022-20255MEDIUMCVSS 4.4EG 4.42022-08-12
In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
- CVE-2022-27840MEDIUMCVSS 4.4EG 4.42022-04-11
Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permission.
- CVE-2021-0093MEDIUMCVSS 4.4EG 4.42022-02-09
Incorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.
Map vulnerabilities like CWE-276 to your infrastructure
EchelonGraph correlates every CVE — across CWE-276 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →