Common Weakness Enumeration
CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
439 vulnerabilities reference this CWE, most recent first.
GHSA-GC28-55G9-F45F
Vulnerability from github – Published: 2022-09-20 00:00 – Updated: 2022-09-22 00:00
VLAI
Details
ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-38577"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-19T16:15:00Z",
"severity": "HIGH"
},
"details": "ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.",
"id": "GHSA-gc28-55g9-f45f",
"modified": "2022-09-22T00:00:26Z",
"published": "2022-09-20T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38577"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1iP9NYUkYEy_FGMpcnTkUWn8nGcqDT02_/view?usp=sharing"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/168427/ProcessMaker-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://processmaker.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF2W-JQMQ-FCM8
Vulnerability from github – Published: 2026-06-30 15:30 – Updated: 2026-08-05 03:30
VLAI
Details
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-4360"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T15:16:57Z",
"severity": "LOW"
},
"details": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=\u0027data\u0027 to the extract() function.",
"id": "GHSA-gf2w-jqmq-fcm8",
"modified": "2026-08-05T03:30:22Z",
"published": "2026-06-30T15:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4360"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/151987"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/151988"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GM3H-H75W-R3WG
Vulnerability from github – Published: 2023-06-27 15:30 – Updated: 2024-04-04 05:12
VLAI
Details
An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-2818"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-27T15:15:10Z",
"severity": "MODERATE"
},
"details": "An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.",
"id": "GHSA-gm3h-h75w-r3wg",
"modified": "2024-04-04T05:12:23Z",
"published": "2023-06-27T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2818"
},
{
"type": "WEB",
"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GQHM-PRC4-8M4C
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2025-11-04 00:32
VLAI
Details
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root privileges.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-54515"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:15:31Z",
"severity": "HIGH"
},
"details": "A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root privileges.",
"id": "GHSA-gqhm-prc4-8m4c",
"modified": "2025-11-04T00:32:16Z",
"published": "2024-12-12T03:33:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54515"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121839"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GQMW-JRGV-446Q
Vulnerability from github – Published: 2025-06-10 12:30 – Updated: 2025-06-11 15:30
VLAI
Details
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-43698"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T12:15:24Z",
"severity": "CRITICAL"
},
"details": "Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. \nThis impacts OmniStudio: before Spring 2025",
"id": "GHSA-gqmw-jrgv-446q",
"modified": "2025-06-11T15:30:26Z",
"published": "2025-06-10T12:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43698"
},
{
"type": "WEB",
"url": "https://help.salesforce.com/s/articleView?id=004980323\u0026type=1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GRJV-GJGR-66G2
Vulnerability from github – Published: 2024-06-20 16:24 – Updated: 2024-11-18 16:26
VLAI
Summary
SpiceDB exclusions can result in no permission returned when permission expected
Details
Background
Use of an exclusion under an arrow that has multiple resources may resolve to NO_PERMISSION when permission is expected.
For example, given this schema:
definition user {}
definition folder {
relation member: user
relation banned: user
permission view = member - banned
}
definition resource {
relation folder: folder
permission view = folder->view
}
If the resource exists under multiple folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that all the folders in which the user is a member be returned
Impact
Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.
Workarounds
None
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/authzed/spicedb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.33.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38361"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-20T16:24:01Z",
"nvd_published_at": "2024-06-20T23:15:52Z",
"severity": "MODERATE"
},
"details": "### Background\n\nUse of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.\n\nFor example, given this schema:\n\n```zed\ndefinition user {}\n\ndefinition folder {\n relation member: user\n relation banned: user\n permission view = member - banned\n}\n\ndefinition resource {\n relation folder: folder\n permission view = folder-\u003eview\n}\n```\n\nIf the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned\n\n### Impact\n\nPermission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API.\n\n### Workarounds\n\nNone\n",
"id": "GHSA-grjv-gjgr-66g2",
"modified": "2024-11-18T16:26:46Z",
"published": "2024-06-20T16:24:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38361"
},
{
"type": "WEB",
"url": "https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbeb"
},
{
"type": "PACKAGE",
"url": "https://github.com/authzed/spicedb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "SpiceDB exclusions can result in no permission returned when permission expected"
}
GHSA-GVJ8-4CJ4-H776
Vulnerability from github – Published: 2022-04-29 15:40 – Updated: 2022-04-29 15:40
VLAI
Summary
Object state limitation has no effect
Details
Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ibexa/core"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ibexa/core"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-29T15:40:48Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.",
"id": "GHSA-gvj8-4cj4-h776",
"modified": "2022-04-29T15:40:48Z",
"published": "2022-04-29T15:40:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ibexa/core/security/advisories/GHSA-gvj8-4cj4-h776"
},
{
"type": "WEB",
"url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge"
},
{
"type": "PACKAGE",
"url": "https://github.com/ibexa/core"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Object state limitation has no effect"
}
GHSA-GW2V-WGMH-28V4
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:54
VLAI
Details
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-6995"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-09T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.",
"id": "GHSA-gw2v-wgmh-28v4",
"modified": "2024-04-04T01:54:45Z",
"published": "2022-05-24T16:55:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6995"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/55537"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GXJ5-6FW2-663J
Vulnerability from github – Published: 2021-12-08 00:01 – Updated: 2021-12-10 00:01
VLAI
Details
There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which can isolate and read synchronization files of other applications across the UID sandbox.
{
"affected": [],
"aliases": [
"CVE-2021-37086"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-07T17:15:00Z",
"severity": "HIGH"
},
"details": "There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which can isolate and read synchronization files of other applications across the UID sandbox.",
"id": "GHSA-gxj5-6fw2-663j",
"modified": "2021-12-10T00:01:23Z",
"published": "2021-12-08T00:01:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37086"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H574-6646-VFXX
Vulnerability from github – Published: 2024-03-14 09:31 – Updated: 2024-05-02 19:01
VLAI
Summary
Apache Airflow: Ignored Airflow Permission
Details
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.
Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.3rc1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-28746"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-15T14:19:23Z",
"nvd_published_at": "2024-03-14T09:15:47Z",
"severity": "MODERATE"
},
"details": "Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.\u00a0\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability\n",
"id": "GHSA-h574-6646-vfxx",
"modified": "2024-05-02T19:01:54Z",
"published": "2024-03-14T09:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28746"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/37881"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/89e7f3e7bdf2126bbbcd959dc10d65ef92773cca"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-46.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/13/5"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Apache Airflow: Ignored Airflow Permission"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.