CWE-276
AllowedIncorrect Default Permissions
Abstraction: Base · Status: Draft
During installation, installed file permissions are set to allow anyone to modify those files.
2035 vulnerabilities reference this CWE, most recent first.
GHSA-952V-34CQ-P7JX
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2011-2782"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-08-03T00:55:00Z",
"severity": "MODERATE"
},
"details": "The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.",
"id": "GHSA-952v-34cq-p7jx",
"modified": "2022-05-13T01:26:26Z",
"published": "2022-05-13T01:26:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2782"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68944"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14100"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=81307"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2011/08/stable-channel-update.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/74232"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-95F9-5FFF-HG3V
Vulnerability from github – Published: 2023-02-28 03:30 – Updated: 2023-03-13 18:30Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure Analytics Advisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer, Analyzer probe server components), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Automation Director: from 8.2.0-00 through 10.6.1-00; Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.0.0-00; Hitachi Ops Center Automator: before 10.9.1-00; Hitachi Ops Center Analyzer: before 10.9.1-00; Hitachi Ops Center Viewpoint: before 10.9.1-00.
{
"affected": [],
"aliases": [
"CVE-2020-36652"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-28T03:15:00Z",
"severity": "HIGH"
},
"details": "Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure Analytics Advisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer, Analyzer probe server components), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Automation Director: from 8.2.0-00 through 10.6.1-00; Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.0.0-00; Hitachi Ops Center Automator: before 10.9.1-00; Hitachi Ops Center Analyzer: before 10.9.1-00; Hitachi Ops Center Viewpoint: before 10.9.1-00.",
"id": "GHSA-95f9-5fff-hg3v",
"modified": "2023-03-13T18:30:43Z",
"published": "2023-02-28T03:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36652"
},
{
"type": "WEB",
"url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-106/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-963M-MGXP-CG5W
Vulnerability from github – Published: 2024-04-29 18:30 – Updated: 2025-03-28 21:30MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.
{
"affected": [],
"aliases": [
"CVE-2023-46270"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T16:15:34Z",
"severity": "LOW"
},
"details": "MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.",
"id": "GHSA-963m-mgxp-cg5w",
"modified": "2025-03-28T21:30:40Z",
"published": "2024-04-29T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46270"
},
{
"type": "WEB",
"url": "https://theunarchiver.com"
},
{
"type": "WEB",
"url": "https://updates.devmate.com/releasenotes/143/com.macpaw.site.theunarchiver.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-974P-HHMC-6H46
Vulnerability from github – Published: 2024-09-13 18:31 – Updated: 2024-11-11 21:31An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.
{
"affected": [],
"aliases": [
"CVE-2024-39924"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-13T18:15:03Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.",
"id": "GHSA-974p-hhmc-6h46",
"modified": "2024-11-11T21:31:47Z",
"published": "2024-09-13T18:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39924"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/blob/1.30.3/src/api/core/emergency_access.rs#L115-L148"
},
{
"type": "WEB",
"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0"
},
{
"type": "WEB",
"url": "https://www.mgm-sp.com/cve/missing-authentication-check-for-emergency-access"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-97HH-RRPX-8434
Vulnerability from github – Published: 2023-10-13 00:30 – Updated: 2024-04-04 08:37An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges.
This issue affects Juniper Networks Junos OS:
- All versions prior to 20.4R3-S5;
- 21.1 versions prior to 21.1R3-S4;
- 21.2 versions prior to 21.2R3-S4;
- 21.3 versions prior to 21.3R3-S3;
- 21.4 versions prior to 21.4R3-S1.
{
"affected": [],
"aliases": [
"CVE-2023-44194"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-13T00:15:12Z",
"severity": "HIGH"
},
"details": "\nAn Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges.\n\nThis issue affects Juniper Networks Junos OS:\n\n\n\n * All versions prior to 20.4R3-S5;\n * 21.1 versions prior to 21.1R3-S4;\n * 21.2 versions prior to 21.2R3-S4;\n * 21.3 versions prior to 21.3R3-S3;\n * 21.4 versions prior to 21.4R3-S1.\n\n\n\n\n\n\n",
"id": "GHSA-97hh-rrpx-8434",
"modified": "2024-04-04T08:37:06Z",
"published": "2023-10-13T00:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44194"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA73158"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-97HX-H624-G753
Vulnerability from github – Published: 2022-06-25 00:01 – Updated: 2022-07-02 00:00Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.
{
"affected": [],
"aliases": [
"CVE-2021-41637"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-24T12:15:00Z",
"severity": "HIGH"
},
"details": "Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the \"Everyone\" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users.",
"id": "GHSA-97hx-h624-g753",
"modified": "2022-07-02T00:00:22Z",
"published": "2022-06-25T00:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41637"
},
{
"type": "WEB",
"url": "https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-984V-WWCJ-4259
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.
{
"affected": [],
"aliases": [
"CVE-2021-25381"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-09T18:15:00Z",
"severity": "HIGH"
},
"details": "Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.",
"id": "GHSA-984v-wwcj-4259",
"modified": "2022-05-24T17:47:00Z",
"published": "2022-05-24T17:47:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25381"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9875-8H62-HQ8G
Vulnerability from github – Published: 2023-04-04 18:30 – Updated: 2023-04-11 18:30An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).
{
"affected": [],
"aliases": [
"CVE-2023-27091"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-04T18:15:00Z",
"severity": "HIGH"
},
"details": "An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).",
"id": "GHSA-9875-8h62-hq8g",
"modified": "2023-04-11T18:30:29Z",
"published": "2023-04-04T18:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27091"
},
{
"type": "WEB",
"url": "https://gitee.com/xiaobingby/TeaCMS/issues/I6GDRU"
},
{
"type": "WEB",
"url": "https://gitee.com/xiaobingby/TeaCMS/issues/I6SXAF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-994G-F47F-5CJV
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:17The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
{
"affected": [],
"aliases": [
"CVE-2015-9475"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-10T17:15:00Z",
"severity": "HIGH"
},
"details": "The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.",
"id": "GHSA-994g-f47f-5cjv",
"modified": "2024-04-04T02:17:20Z",
"published": "2022-05-24T16:58:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9475"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/8061"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-99F9-J8R3-P853
Vulnerability from github – Published: 2026-06-17 21:34 – Updated: 2026-06-19 14:48Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "hermes-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53870"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T14:48:48Z",
"nvd_published_at": "2026-06-17T19:18:10Z",
"severity": "MODERATE"
},
"details": "Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.",
"id": "GHSA-99f9-j8r3-p853",
"modified": "2026-06-19T14:48:48Z",
"published": "2026-06-17T21:34:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53870"
},
{
"type": "WEB",
"url": "https://github.com/NousResearch/hermes-agent/pull/30917"
},
{
"type": "WEB",
"url": "https://github.com/NousResearch/hermes-agent/pull/31469"
},
{
"type": "WEB",
"url": "https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8"
},
{
"type": "PACKAGE",
"url": "https://github.com/NousResearch/hermes-agent"
},
{
"type": "WEB",
"url": "https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)"
}
Mitigation MIT-1
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.