Common Weakness Enumeration
CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
437 vulnerabilities reference this CWE, most recent first.
GHSA-67CG-J2QQ-7WV4
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-15 21:30
VLAI
Details
Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-40767"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T21:16:49Z",
"severity": "HIGH"
},
"details": "Unauthenticated Broken Access Control in wpForo Forum \u003c 3.0.2 versions.",
"id": "GHSA-67cg-j2qq-7wv4",
"modified": "2026-06-15T21:30:46Z",
"published": "2026-06-15T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40767"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-0-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6879-GF6Q-3QMJ
Vulnerability from github – Published: 2024-09-17 00:31 – Updated: 2025-11-04 18:31
VLAI
Details
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted network settings.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-40770"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:48Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted network settings.",
"id": "GHSA-6879-gf6q-3qmj",
"modified": "2025-11-04T18:31:19Z",
"published": "2024-09-17T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40770"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121238"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6FQ2-7QRW-4C53
Vulnerability from github – Published: 2023-06-26 21:30 – Updated: 2024-04-04 05:10
VLAI
Details
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-2993"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T20:15:10Z",
"severity": "MODERATE"
},
"details": "A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.",
"id": "GHSA-6fq2-7qrw-4c53",
"modified": "2024-04-04T05:10:47Z",
"published": "2023-06-26T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2993"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-127357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6JRG-WP8H-9245
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:24
VLAI
Details
OX App Suite through 7.10.2 has Insecure Permissions.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2019-14226"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-14T17:15:00Z",
"severity": "HIGH"
},
"details": "OX App Suite through 7.10.2 has Insecure Permissions.",
"id": "GHSA-6jrg-wp8h-9245",
"modified": "2024-04-04T02:24:25Z",
"published": "2022-05-24T16:58:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14226"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2019/Oct/25"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6M9F-8VWQ-97PM
Vulnerability from github – Published: 2022-05-02 04:00 – Updated: 2024-02-08 22:08
VLAI
Summary
Smarty Does Not Consider Umask Values When Setting Permissions
Details
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "smarty/smarty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-beta4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2009-5054"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-08T22:08:36Z",
"nvd_published_at": "2011-02-03T17:00:00Z",
"severity": "MODERATE"
},
"details": "Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.",
"id": "GHSA-6m9f-8vwq-97pm",
"modified": "2024-02-08T22:08:36Z",
"published": "2022-05-02T04:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-5054"
},
{
"type": "PACKAGE",
"url": "https://github.com/smarty-php/smarty"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20101116174040/http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txt"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Smarty Does Not Consider Umask Values When Setting Permissions"
}
GHSA-6P7M-F494-CJVP
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32
VLAI
Details
Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-3762"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T16:29:00Z",
"severity": "MODERATE"
},
"details": "Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.",
"id": "GHSA-6p7m-f494-cjvp",
"modified": "2022-05-13T01:32:20Z",
"published": "2022-05-13T01:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3762"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/358339"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=nc-sa-2018-002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6R8G-4HXG-92RF
Vulnerability from github – Published: 2024-04-08 09:31 – Updated: 2024-10-31 21:31
VLAI
Details
Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-52542"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T09:15:08Z",
"severity": "MODERATE"
},
"details": "Permission verification vulnerability in the system module.\nImpact: Successful exploitation of this vulnerability will affect availability.",
"id": "GHSA-6r8g-4hxg-92rf",
"modified": "2024-10-31T21:31:44Z",
"published": "2024-04-08T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52542"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/3"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6V2P-8Q89-F8P6
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28
VLAI
Details
In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129151407
{
"affected": [],
"aliases": [
"CVE-2020-0327"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-18T16:15:00Z",
"severity": "MODERATE"
},
"details": "In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129151407",
"id": "GHSA-6v2p-8q89-f8p6",
"modified": "2022-05-24T17:28:39Z",
"published": "2022-05-24T17:28:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0327"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6WVR-WRJW-5G3C
Vulnerability from github – Published: 2025-06-10 12:30 – Updated: 2025-06-10 18:32
VLAI
Details
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.
This impacts OmniStudio: before Spring 2025.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-43700"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T12:15:24Z",
"severity": "HIGH"
},
"details": "Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.\u00a0\n\nThis impacts OmniStudio: before Spring 2025.",
"id": "GHSA-6wvr-wrjw-5g3c",
"modified": "2025-06-10T18:32:25Z",
"published": "2025-06-10T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43700"
},
{
"type": "WEB",
"url": "https://help.salesforce.com/s/articleView?id=004980323\u0026type=1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-72CP-Q9J9-FHVH
Vulnerability from github – Published: 2024-10-02 15:30 – Updated: 2024-10-03 21:31
VLAI
Details
A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.
Severity
8.4 (High)
{
"affected": [],
"aliases": [
"CVE-2024-44193"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-02T15:15:14Z",
"severity": "HIGH"
},
"details": "A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.",
"id": "GHSA-72cp-q9j9-fhvh",
"modified": "2024-10-03T21:31:04Z",
"published": "2024-10-02T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44193"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121328"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.