CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
439 vulnerabilities reference this CWE, most recent first.
GHSA-VM96-HFHP-3PVP
Vulnerability from github – Published: 2024-07-30 00:34 – Updated: 2026-04-02 21:31A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An app may be able to modify protected parts of the file system.
{
"affected": [],
"aliases": [
"CVE-2024-27888"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T23:15:11Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An app may be able to modify protected parts of the file system.",
"id": "GHSA-vm96-hfhp-3pvp",
"modified": "2026-04-02T21:31:47Z",
"published": "2024-07-30T00:34:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27888"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120895"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214084"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214084"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VR9C-MCXV-87CW
Vulnerability from github – Published: 2022-08-23 00:00 – Updated: 2022-08-25 00:00Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low privileged local attacker may potentially exploit this vulnerability, leading to limited information disclosure.
{
"affected": [],
"aliases": [
"CVE-2022-31237"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-22T17:15:00Z",
"severity": "LOW"
},
"details": "Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability in SyncIQ. A low privileged local attacker may potentially exploit this vulnerability, leading to limited information disclosure.",
"id": "GHSA-vr9c-mcxv-87cw",
"modified": "2022-08-25T00:00:28Z",
"published": "2022-08-23T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31237"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000201094/dsa-2022-149-dell-emc-powerscale-onefs-security-update?lang=en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VV7X-7W4M-Q72F
Vulnerability from github – Published: 2022-09-21 20:36 – Updated: 2022-09-27 06:12Impact
This issue allows a client of the API to retrieve more information than the client’s OAuth scope permits when making “search-type” requests. This issue would not allow a client to retrieve information about individuals other than those the client was already authorized to access.
Patches
We recommend that users of fhir-works-on-aws-authz-smart 3.1.1 or 3.1.2 upgrade to version 3.1.3 or higher immediately. Versions 3.1.0 and below are unaffected.
Workarounds
There is no workaround for this issue. Please upgrade fhir-works-on-aws-authz-smart to version 3.1.3 or higher.
References
https://github.com/awslabs/fhir-works-on-aws-deployment https://github.com/awslabs/fhir-works-on-aws-authz-smart
For more information
If you have any questions or comments about this advisory:
Email us at fhir-works-on-aws-dev@amazon.com
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fhir-works-on-aws-authz-smart"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.1"
},
{
"fixed": "3.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39230"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-21T20:36:50Z",
"nvd_published_at": "2022-09-23T07:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThis issue allows a client of the API to retrieve more information than the client\u2019s OAuth scope permits when making \u201csearch-type\u201d requests. This issue would not allow a client to retrieve information about individuals other than those the client was already authorized to access.\n\n### Patches\n\nWe recommend that users of fhir-works-on-aws-authz-smart 3.1.1 or 3.1.2 upgrade to version 3.1.3 or higher immediately. Versions 3.1.0 and below are unaffected.\n\n### Workarounds\n\nThere is no workaround for this issue. Please upgrade fhir-works-on-aws-authz-smart to version 3.1.3 or higher.\n\n### References\n\nhttps://github.com/awslabs/fhir-works-on-aws-deployment\nhttps://github.com/awslabs/fhir-works-on-aws-authz-smart\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [fhir-works-on-aws-dev@amazon.com](mailto:fhir-works-on-aws-dev@amazon.com)\n",
"id": "GHSA-vv7x-7w4m-q72f",
"modified": "2022-09-27T06:12:12Z",
"published": "2022-09-21T20:36:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/awslabs/fhir-works-on-aws-authz-smart/security/advisories/GHSA-vv7x-7w4m-q72f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39230"
},
{
"type": "WEB",
"url": "https://github.com/awslabs/fhir-works-on-aws-authz-smart/commit/203bbc0dd17de748c36b33c68b866ed2dfd613d3"
},
{
"type": "PACKAGE",
"url": "https://github.com/awslabs/fhir-works-on-aws-authz-smart"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "fhir-works-on-aws-authz-smart handles permissions improperly"
}
GHSA-VVJV-97J8-94XH
Vulnerability from github – Published: 2023-02-28 23:19 – Updated: 2024-11-18 23:09Impact
Assigning existing users to a different organization is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access.
Patches
Update to 3.8.0
Workarounds
None
References
None
For more information
If you have any questions or comments about this advisory: * Email us at vantage6@iknl.nl
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vantage6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-22738"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-28T23:19:24Z",
"nvd_published_at": "2023-03-01T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nAssigning existing users to a different organization is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access.\n\n### Patches\nUpdate to 3.8.0\n\n### Workarounds\nNone\n\n### References\nNone\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [vantage6@iknl.nl](mailto:vantage6@iknl.nl)\n",
"id": "GHSA-vvjv-97j8-94xh",
"modified": "2024-11-18T23:09:56Z",
"published": "2023-02-28T23:19:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22738"
},
{
"type": "WEB",
"url": "https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-53.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/vantage6/vantage6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "vantage6 vulnerable to Improper Preservation of Permissions"
}
GHSA-VW24-GW6X-F64V
Vulnerability from github – Published: 2025-01-06 18:31 – Updated: 2025-01-07 21:30SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
{
"affected": [],
"aliases": [
"CVE-2024-54879"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T18:15:21Z",
"severity": "CRITICAL"
},
"details": "SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.",
"id": "GHSA-vw24-gw6x-f64v",
"modified": "2025-01-07T21:30:55Z",
"published": "2025-01-06T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54879"
},
{
"type": "WEB",
"url": "https://blog.csdn.net/weixin_46686336/article/details/144797242"
},
{
"type": "WEB",
"url": "http://seacms.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VXH2-R3FH-MQH4
Vulnerability from github – Published: 2023-11-30 06:33 – Updated: 2023-12-05 18:30Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.
{
"affected": [],
"aliases": [
"CVE-2023-47463"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-30T05:15:08Z",
"severity": "CRITICAL"
},
"details": "Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.",
"id": "GHSA-vxh2-r3fh-mqh4",
"modified": "2023-12-05T18:30:22Z",
"published": "2023-11-30T06:33:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47463"
},
{
"type": "WEB",
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/an%20unauthenticated%20remote%20code%20execution.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W24G-6MF8-65CJ
Vulnerability from github – Published: 2026-01-26 21:30 – Updated: 2026-05-19 15:31A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.
{
"affected": [],
"aliases": [
"CVE-2025-9615"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-26T20:16:09Z",
"severity": "LOW"
},
"details": "A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system\u0027s network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.",
"id": "GHSA-w24g-6mf8-65cj",
"modified": "2026-05-19T15:31:19Z",
"published": "2026-01-26T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9615"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18142"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:18597"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-9615"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391503"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2327"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W5G9-XVWM-4QF8
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-10-22 00:31Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
{
"affected": [],
"aliases": [
"CVE-2017-8543"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-15T01:29:00Z",
"severity": "CRITICAL"
},
"details": "Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory, aka \"Windows Search Remote Code Execution Vulnerability\".",
"id": "GHSA-w5g9-xvwm-4qf8",
"modified": "2025-10-22T00:31:23Z",
"published": "2022-05-13T01:47:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8543"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8543"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8543"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98824"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038667"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W643-WVHG-95X9
Vulnerability from github – Published: 2023-06-23 18:30 – Updated: 2024-04-04 05:08This issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4, watchOS 9.5. Entitlements and privacy permissions granted to this app may be used by a malicious app
{
"affected": [],
"aliases": [
"CVE-2023-32400"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-23T18:15:12Z",
"severity": "MODERATE"
},
"details": "This issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4, watchOS 9.5. Entitlements and privacy permissions granted to this app may be used by a malicious app",
"id": "GHSA-w643-wvhg-95x9",
"modified": "2024-04-04T05:08:02Z",
"published": "2023-06-23T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32400"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213757"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213758"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213764"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6W8-XWP9-3VWQ
Vulnerability from github – Published: 2025-01-08 21:32 – Updated: 2025-01-31 18:31Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise.
{
"affected": [],
"aliases": [
"CVE-2024-52869"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T21:15:12Z",
"severity": "MODERATE"
},
"details": "Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise.",
"id": "GHSA-w6w8-xwp9-3vwq",
"modified": "2025-01-31T18:31:04Z",
"published": "2025-01-08T21:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52869"
},
{
"type": "WEB",
"url": "https://chrismanson.com/CVE/cve-2024-52869.html"
},
{
"type": "WEB",
"url": "https://www.teradata.com/trust-security-center/data-security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.