Common Weakness Enumeration
CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
439 vulnerabilities reference this CWE, most recent first.
GHSA-XH2Q-MW6G-7HG3
Vulnerability from github – Published: 2025-06-05 21:30 – Updated: 2026-01-13 21:31
VLAI
Details
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-43026"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-05T20:15:26Z",
"severity": "HIGH"
},
"details": "A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.",
"id": "GHSA-xh2q-mw6g-7hg3",
"modified": "2026-01-13T21:31:39Z",
"published": "2025-06-05T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43026"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_12617979-12618008-16/hpsbgn04022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XH36-JJPQ-3CMR
Vulnerability from github – Published: 2026-05-11 12:32 – Updated: 2026-05-11 12:32
VLAI
Details
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.
A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-8325"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-11T10:16:13Z",
"severity": "MODERATE"
},
"details": "The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the \u0027Internal/Everyone\u0027 role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions.\n\nA malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.",
"id": "GHSA-xh36-jjpq-3cmr",
"modified": "2026-05-11T12:32:31Z",
"published": "2026-05-11T12:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8325"
},
{
"type": "WEB",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XH6M-7CR7-XX66
Vulnerability from github – Published: 2024-02-27 21:54 – Updated: 2025-05-30 12:36
VLAI
Summary
Missing permission checks on Hazelcast client protocol
Details
Impact
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
Patches
Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1
Workarounds
There is no known workaround.
Severity
7.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.0"
},
{
"last_affected": "5.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.1"
},
{
"last_affected": "5.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.4"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-all"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-all"
},
"ranges": [
{
"events": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45859"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-27T21:54:15Z",
"nvd_published_at": "2024-02-28T22:15:26Z",
"severity": "HIGH"
},
"details": "### Impact\nIn Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don\u0027t check permissions properly, allowing authenticated users to access data stored in the cluster.\n\n### Patches\nFix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1\n\n### Workarounds\nThere is no known workaround.",
"id": "GHSA-xh6m-7cr7-xx66",
"modified": "2025-05-30T12:36:04Z",
"published": "2024-02-27T21:54:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45859"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/pull/25509"
},
{
"type": "PACKAGE",
"url": "https://github.com/hazelcast/hazelcast"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Missing permission checks on Hazelcast client protocol"
}
GHSA-XJC5-M98P-6F2C
Vulnerability from github – Published: 2023-11-28 15:30 – Updated: 2026-02-23 09:31
VLAI
Details
Improperly calculated effective permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 could produce a faulty result if an object used a specific configuration of metadata-driven permissions.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-6239"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-28T14:15:07Z",
"severity": "MODERATE"
},
"details": "Improperly calculated effective permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before\u00a023.11.13168.7 could produce a faulty result if an object used a specific configuration of metadata-driven permissions.",
"id": "GHSA-xjc5-m98p-6f2c",
"modified": "2026-02-23T09:31:18Z",
"published": "2023-11-28T15:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6239"
},
{
"type": "WEB",
"url": "https://empower.m-files.com/security-advisories/CVE-2023-6239"
},
{
"type": "WEB",
"url": "https://product.m-files.com/security-advisories/cve-2023-6239"
},
{
"type": "WEB",
"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XPM2-F32F-Q35F
Vulnerability from github – Published: 2024-12-07 00:31 – Updated: 2024-12-12 03:33
VLAI
Details
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-41648"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T22:15:20Z",
"severity": "HIGH"
},
"details": "Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.",
"id": "GHSA-xpm2-f32f-q35f",
"modified": "2024-12-12T03:33:00Z",
"published": "2024-12-07T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41648"
},
{
"type": "WEB",
"url": "https://github.com/ros-navigation/navigation2/issues/4438"
},
{
"type": "WEB",
"url": "https://github.com/ros-navigation/navigation2/pull/4463"
},
{
"type": "WEB",
"url": "https://github.com/GoesM/ROS-CVE-CNVDs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XQF3-Q69C-JC7C
Vulnerability from github – Published: 2024-12-10 21:30 – Updated: 2024-12-11 18:30
VLAI
Details
Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.
Severity
4.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-50931"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-10T19:15:30Z",
"severity": "MODERATE"
},
"details": "Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.",
"id": "GHSA-xqf3-q69c-jc7c",
"modified": "2024-12-11T18:30:42Z",
"published": "2024-12-10T21:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50931"
},
{
"type": "WEB",
"url": "https://github.com/CNK2100/2024-CVE/blob/main/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XQMF-WF6X-2CX6
Vulnerability from github – Published: 2022-11-11 19:00 – Updated: 2022-11-17 18:30
VLAI
Details
Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-26024"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-11T16:15:00Z",
"severity": "HIGH"
},
"details": "Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-xqmf-wf6x-2cx6",
"modified": "2022-11-17T18:30:30Z",
"published": "2022-11-11T19:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26024"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00689.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRVP-GX9P-8CH2
Vulnerability from github – Published: 2024-09-17 00:31 – Updated: 2025-11-04 18:31
VLAI
Details
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-27795"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:47Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.",
"id": "GHSA-xrvp-gx9p-8ch2",
"modified": "2025-11-04T18:31:19Z",
"published": "2024-09-17T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27795"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121238"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXMH-66CH-6MV4
Vulnerability from github – Published: 2025-02-01 00:31 – Updated: 2025-02-03 21:31
VLAI
Details
EasyVirt DCScope <=8.6.0 and CO2Scope <=1.3.0 are vulnerable to Incorrect Access Control. This vulnerability allows the api to be used to create/modify/delete information about aliases (users) / users (groups) / roles.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-53355"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-31T22:15:09Z",
"severity": "HIGH"
},
"details": "EasyVirt DCScope \u003c=8.6.0 and CO2Scope \u003c=1.3.0 are vulnerable to Incorrect Access Control. This vulnerability allows the api to be used to create/modify/delete information about aliases (users) / users (groups) / roles.",
"id": "GHSA-xxmh-66ch-6mv4",
"modified": "2025-02-03T21:31:49Z",
"published": "2025-02-01T00:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53355"
},
{
"type": "WEB",
"url": "https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53355.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.