CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
A kind of CWE-732 Incorrect Permission Assignment for Critical Resource.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft powershell, powershell 7.6, microsoft powershell 7.4 +1 more +3 morePowerShell Elevation of Privilege Vulnerability7.3 High
- amd vitis™ unified installer for fpgas & adaptive socs in windowsWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a...7.3 High
- amd vitis™ embedded single file download (sfd) for windowsWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a...7.3 High
- samsung mobile bixbyIncorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to...7.2 High
- synology assistantAn incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows...7.3 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.8 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.8 High
- codexu notegenNoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python8.3 High
- bizerba connect.brainInsecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN7.3 High
- bizerba brain2Insecure permission assignment due to execution of LogPathConfig.exe during setup7.3 High
- absolute secure accessPrivilge misconfiguration in Secure Access installers8.5 High
- nixos nixpkgsnixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`8.5 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +10 more +12 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- lima-vm limaLima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket8.2 High
- yeswikiYesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action9.1 Critical
- fuji electric co.,ltd. pupsmanIncorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can...8.5 High
- No product listedPBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\....7.8 High
- tursodatabase turso-cliturso-cli persists Turso platform JWT with world-readable (0o644) file permissions5.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user...4.3 Medium
- nextflow-io nextflowNextflow: Incorrect default permissions in the nextflow auth login command5.5 Medium
- fatpipe warpWarp may allow terminal output to access the local clipboard through OSC 528.1 High
- aruba arubasignIncorrect permissions in ArubaSign by Aruba8.8 High
- browserbase skillsBrowserbase Skills Autobrowse Trace Artifact default permission4.8 Medium
- nousresearch hermes-agentHermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files6.8 Medium
- netskope clientNetskope Client Service Insufficient Access Controls6.8 Medium
- openclawOpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json5.7 Medium
- sony corporation optical disc archive software for windowsIncorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and...5.4 Medium
- @clerk nuxtNuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux6.8 Medium
- aws kiro ideInsecure Permissions on Authentication Token Cache File in Kiro IDE6.8 Medium
- apache activemqApache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default8.8 High
- otrsIncorrect handling of permissions in External Interface Config Item List module3.5 Low
- otrsWrong Permission Handling in Document Search Article Meta Filters3.5 Low
- portainer community editionInsecure default permissions in Portainer CE8.5 High
- canonical multipassLocal Privilege Escalation in Canonical Multipass7.8 High
- codesys development systemIncorrect Default Permissions in CODESYS Development System8.5 High
- codesys development systemIncorrect Default Permissions in CODESYS Development System8.5 High
- splinterware system scheduler proSplinterware System Scheduler Pro 5.12 Privilege Escalation8.6 High
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through...5.3 Medium
- progress moveit automationIncorrect default permissions vulnerability in Progress Software MOVEit Automation6.5 Medium
- windmill-labs windmillWindmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration8.6 High
- amd athlon™ 3000 series desktop processors with radeon™ graphics, athlon™ 3000 series mobile processors with radeon™ graphics, ryzen™ 3000 series desktop processors +30 more +32 moreInsecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could...6.9 Medium
- amd athlon™ 3000 series desktop processors with radeon™ graphics, athlon™ 3000 series mobile processors with radeon™ graphics, epyc™ 4004 series processors +43 more +45 moreIncorrect default permissions in the installation directory for the AMD chipset driver could...8.5 High
- amd athlon™ 3000 series desktop processors with radeon™ graphics (formerly codenamed "picasso"), athlon™ 3000 series mobile processors with radeon™ graphics (formerly codenamed "dali"), athlon™ 3000 series mobile processors with radeon™ graphics (formerly codenamed "picasso") +49 more +51 moreIncorrect default permissions in the installation directory for the AMD general-purpose input...7.0 High
- sap netweaver application server abapCSS Injection vulnerability in SAP NetWeaver Application Server ABAP3.1 Low
- samsung android, samsung mobile devices +1 moreIncorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local...6.8 Medium
- No product listedHiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when...6.8 Medium
- No product listedIncorrect default permissions for some Intel(R) NPU Driver software installers before version 32...5.4 Medium
- vmware spring aiChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage7.5 High
- cribl edgeLocal privilege escalation to SYSTEM in Cribl Edge for Windows8.5 High
- pcvisit remote host modulLocal Privilege Escalation in pcvisit service client8.5 High
- Show moreLoading…