CWE-276— Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.— MITRE CWE catalog

1,759 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-276page 34 of 36

CVE-2020-6441MEDIUMCVSS 4.3EG 4.3
2020-04-13
Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.
CVE-2020-6431MEDIUMCVSS 4.3EG 4.3
2020-04-13
Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVE-2020-2118MEDIUMCVSS 4.3EG 4.3
2020-02-12
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-20106MEDIUMCVSS 4.3EG 4.3
2020-02-06
Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting p…
CVE-2020-7967MEDIUMCVSS 4.3EG 4.3
2020-02-05
GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
CVE-2013-4764MEDIUMCVSS 4.3EG 4.3
2019-12-27
Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations without permission.
CVE-2019-16554MEDIUMCVSS 4.3EG 4.3
2019-12-17
A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
CVE-2019-15011MEDIUMCVSS 4.3EG 4.3
2019-12-17
The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclo…
CVE-2012-1157MEDIUMCVSS 4.3EG 4.3
2019-11-14
Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
CVE-2019-10474MEDIUMCVSS 4.3EG 4.3
2019-10-23
A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.
CVE-2019-10473MEDIUMCVSS 4.3EG 4.3
2019-10-23
A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10465MEDIUMCVSS 4.3EG 4.3
2019-10-23
A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attac…
CVE-2017-9505MEDIUMCVSS 4.3EG 4.3
2017-06-15
Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notification…
CVE-2011-2782MEDIUMCVSS v2 4.3EG 4.3
2011-08-03
The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
CVE-2024-6476MEDIUMCVSS 4.2EG 4.2
2024-11-26
Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privileges by redirecting a file deletion upon service restart. Axis has released patched versions for…
CVE-2020-29503MEDIUMCVSS 4.1EG 4.1
2021-07-19
Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the information disclosure of certain system directory.
CVE-2025-32803MEDIUMCVSS 4.0EG 4.0
2025-05-28
In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
CVE-2024-34679MEDIUMCVSS 4.0EG 4.0
2024-11-06
Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.
CVE-2024-47825MEDIUMCVSS 4.0EG 4.0
2024-10-21
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if th…
CVE-2024-34617MEDIUMCVSS 4.0EG 4.0
2024-08-07
Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application.
CVE-2022-23996MEDIUMCVSS 4.0EG 4.0
2022-02-11
Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.
CVE-2022-23995MEDIUMCVSS 4.0EG 4.0
2022-02-11
Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.
CVE-2021-25359MEDIUMCVSS 4.0EG 4.0
2021-04-09
An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted applications.
CVE-2021-25358MEDIUMCVSS 4.0EG 4.0
2021-04-09
A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission via untrusted applications.
CVE-2019-18900MEDIUMCVSS 4.0EG 4.0
2020-01-24
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. …
CVE-2019-3687MEDIUMCVSS 4.0EG 4.0
2020-01-24
The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 8…
CVE-2023-43081MEDIUMCVSS 3.3EG 4.0
2023-11-22
PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. A low Privileged local attacker could potentially exploit this vulnerability, leading to overwriting…
CVE-2014-8327MEDIUMCVSS v2 4.0EG 4.0
2014-10-27
The fal_sftp extension before 0.2.6 for TYPO3 uses weak permissions for sFTP driver files and folders, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVE-2010-4176MEDIUMCVSS v2 4.0EG 4.0
2010-12-07
plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
CVE-2021-34395LOWCVSS 3.9EG 3.9
2021-06-22
Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privileges, which might lead to limited information disclosure, a low risk of modifcation…
CVE-2017-5686LOWCVSS 3.9EG 3.9
2017-04-03
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system to gain access to personal information.
CVE-2017-5685LOWCVSS 3.9EG 3.9
2017-04-03
The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information.
CVE-2017-5684LOWCVSS 3.9EG 3.9
2017-04-03
The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information.
CVE-2025-54085LOWCVSS 3.8EG 3.8
2025-07-31
CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those perm…
CVE-2021-3155LOWCVSS 3.8EG 3.8
2022-02-17
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.…
CVE-2024-42188LOWCVSS 3.7EG 3.7
2024-11-14
HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.
CVE-2024-21012LOWCVSS 3.7EG 3.7
2024-04-16
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracl…
CVE-2026-48190LOWCVSS 3.5EG 3.5
2026-06-01
An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has t…
CVE-2026-48191LOWCVSS 3.5EG 3.5
2026-06-01
An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to the…
CVE-2025-55074LOWCVSS 3.5EG 3.5
2025-11-18
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects
CVE-2025-48070LOWCVSS 3.5EG 3.5
2025-05-21
Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when c…
CVE-2024-4226LOWCVSS 3.5EG 3.5
2024-04-30
It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions l…
CVE-2021-32725LOWCVSS 3.5EG 3.5
2021-07-12
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in ver…
CVE-2021-21438LOWCVSS 3.5EG 3.5
2021-03-22
Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions.
CVE-2021-21436LOWCVSS 3.5EG 3.5
2021-02-08
Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions.
CVE-2026-108503LOWCVSS 3.3EG 3.3
2026-10-10
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.
CVE-2026-48935LOWCVSS 3.3EG 3.3
2026-06-26
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and …
CVE-2026-12823LOWCVSS 3.3EG 3.3
2026-06-22
A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a…
CVE-2025-59485LOWCVSS 3.3EG 3.3
2025-11-25
Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an arbitrary file could be placed in the specific folder by a user who can log in to the system where …
CVE-2025-54086LOWCVSS 3.3EG 3.3
2025-10-02
CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low…

Map vulnerabilities like CWE-276 to your infrastructure

EchelonGraph correlates every CVE — across CWE-276 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →