CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
439 vulnerabilities reference this CWE, most recent first.
GHSA-PFH7-Q24C-MJWH
Vulnerability from github – Published: 2024-04-15 21:30 – Updated: 2025-04-11 18:30HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.
{
"affected": [],
"aliases": [
"CVE-2024-23560"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T20:15:10Z",
"severity": "MODERATE"
},
"details": "HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.",
"id": "GHSA-pfh7-q24c-mjwh",
"modified": "2025-04-11T18:30:32Z",
"published": "2024-04-15T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23560"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0111925"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PGPC-G587-47X9
Vulnerability from github – Published: 2022-03-17 00:00 – Updated: 2022-03-24 00:00In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-209965481
{
"affected": [],
"aliases": [
"CVE-2021-39704"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-16T15:15:00Z",
"severity": "HIGH"
},
"details": "In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-209965481",
"id": "GHSA-pgpc-g587-47x9",
"modified": "2022-03-24T00:00:38Z",
"published": "2022-03-17T00:00:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39704"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PMF6-RCX4-V53V
Vulnerability from github – Published: 2026-07-06 21:53 – Updated: 2026-07-06 21:53When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).
$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret # uutils:
prw-r--r-- secret # changed to 644 (GNU leaves it 000)
Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.
Remediation: Acknowledged by Canonical; fixed in PR #10376.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.
Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_mkfifo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35341"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T21:53:34Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "When `mkfifo()` fails (e.g. target already exists), the code shows an error but is missing a `continue;`, so it falls through to `fs::set_permissions` and changes the permissions of the pre-existing file to the default FIFO mode (`0o666` \u0026 umask -\u003e `0644`).\n\n```\n$ touch secret; chmod 000 secret\n$ coreutils mkfifo secret fifo3 fifo4\nmkfifo: cannot create fifo \u0027secret\u0027: File exists\n$ ll secret # uutils:\nprw-r--r-- secret # changed to 644 (GNU leaves it 000)\n```\n\n**Impact:** an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add `continue;` after the error.\n\n**Remediation:** Acknowledged by Canonical; fixed in PR #10376.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.8. Credit: Zellic._\n\n_Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 \u00b7 CVE-2026-35341_",
"id": "GHSA-pmf6-rcx4-v53v",
"modified": "2026-07-06T21:53:34Z",
"published": "2026-07-06T21:53:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-pmf6-rcx4-v53v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35341"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/issues/10020"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/10376"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "mkfifo: permissions of an existing file are changed after FIFO creation fails"
}
GHSA-PMR6-F78J-PQ2C
Vulnerability from github – Published: 2022-08-28 00:00 – Updated: 2022-09-02 00:01Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
{
"affected": [],
"aliases": [
"CVE-2022-2787"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-27T12:15:00Z",
"severity": "MODERATE"
},
"details": "Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.",
"id": "GHSA-pmr6-f78j-pq2c",
"modified": "2022-09-02T00:01:06Z",
"published": "2022-08-28T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2787"
},
{
"type": "WEB",
"url": "https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-security-announce/2022/msg00182.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202210-11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PMR9-53H4-Q7GR
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an attack and bypass authentication on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-32465"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-04T19:15:00Z",
"severity": "HIGH"
},
"details": "An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote user to perform an attack and bypass authentication on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-pmr9-53h4-q7gr",
"modified": "2022-05-24T19:09:54Z",
"published": "2022-05-24T19:09:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32465"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/jp/solution/000287796"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000287819"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-911"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PPJ8-867G-RGJR
Vulnerability from github – Published: 2023-07-24 18:30 – Updated: 2024-04-17 18:31A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.
{
"affected": [],
"aliases": [
"CVE-2023-1386"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-24T16:15:11Z",
"severity": "HIGH"
},
"details": "A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.",
"id": "GHSA-ppj8-867g-rgjr",
"modified": "2024-04-17T18:31:30Z",
"published": "2023-07-24T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1386"
},
{
"type": "WEB",
"url": "https://github.com/v9fs/linux/issues/29"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-1386"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2223985"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-ppj8-867g-rgjr"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230831-0005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PQFC-VH74-FMV2
Vulnerability from github – Published: 2022-05-24 17:18 – Updated: 2022-05-24 17:18In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).
{
"affected": [],
"aliases": [
"CVE-2020-13230"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-20T14:15:00Z",
"severity": "MODERATE"
},
"details": "In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).",
"id": "GHSA-pqfc-vh74-fmv2",
"modified": "2022-05-24T17:18:12Z",
"published": "2022-05-24T17:18:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13230"
},
{
"type": "WEB",
"url": "https://github.com/Cacti/cacti/issues/3343"
},
{
"type": "WEB",
"url": "https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PXQF-JG9M-J88F
Vulnerability from github – Published: 2024-12-07 00:31 – Updated: 2024-12-12 03:32Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component.
{
"affected": [],
"aliases": [
"CVE-2024-41644"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T22:15:20Z",
"severity": "CRITICAL"
},
"details": "Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component.",
"id": "GHSA-pxqf-jg9m-j88f",
"modified": "2024-12-12T03:32:59Z",
"published": "2024-12-07T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41644"
},
{
"type": "WEB",
"url": "https://github.com/ros-navigation/navigation2/issues/4496"
},
{
"type": "WEB",
"url": "https://github.com/ros-navigation/navigation2/pull/4521"
},
{
"type": "WEB",
"url": "https://github.com/GoesM/ROS-CVE-CNVDs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q27X-Q82P-47RV
Vulnerability from github – Published: 2024-09-17 00:31 – Updated: 2025-11-04 18:31A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
{
"affected": [],
"aliases": [
"CVE-2024-27858"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:47Z",
"severity": "MODERATE"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.",
"id": "GHSA-q27x-q82p-47rv",
"modified": "2025-11-04T18:31:19Z",
"published": "2024-09-17T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27858"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121238"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q32M-5WQX-F57M
Vulnerability from github – Published: 2023-05-22 15:30 – Updated: 2024-04-04 04:16Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be exploited to gain full administrator privileges on the system.
{
"affected": [],
"aliases": [
"CVE-2023-31923"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-22T15:15:09Z",
"severity": "HIGH"
},
"details": "Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with \"User Operator\" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be exploited to gain full administrator privileges on the system.",
"id": "GHSA-q32m-5wqx-f57m",
"modified": "2024-04-04T04:16:23Z",
"published": "2023-05-22T15:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31923"
},
{
"type": "WEB",
"url": "https://nobugescapes.com/blog/creating-a-new-user-with-admin-privilege"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.