CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
569 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-40585 — A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain
- CVE-2024-27144 — Pre-authenticated Remote Code Execution
- CVE-2025-24891 — Dumb Drop has an arbitrary file overwrite and path traversal for root shell
- CVE-2026-21765 — HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
- CVE-2025-62577 — ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged
- CVE-2025-12100 — MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories
- CVE-2025-11575 — MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories
- CVE-2025-11535 — MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories
- CVE-2025-10314 — Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows
- CVE-2024-13972 — A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.
- CVE-2025-4660 — Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access
- CVE-2026-24780 — AutoGPT is Vulnerable to RCE via Disabled Block Execution
- CVE-2026-32680 — The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installat
- CVE-2026-26034 — UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vul
- CVE-2026-23703 — The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability.
- CVE-2025-8098 — An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate pri
- CVE-2025-57846 — Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a loc
- CVE-2025-43596 — MSP360 Backup (for Windows) insecure filesystem permissions
- CVE-2025-43595 — MSP360 Backup (for Linux) insecure filesystem permissions
- CVE-2025-34333 — AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE
Recently published
- CVE-2026-52766 — YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
- CVE-2026-77393 — Inductive Automation Ignition Incorrect Default Permissions
- CVE-2026-81302 — PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execu
- CVE-2026-9634 — Redundancy Module Configuration Tool - Multiple Vulnerabilities
- CVE-2026-9633 — Redundancy Module Configuration Tool - Multiple Vulnerabilities
- CVE-2026-81682 — openssl_encrypt before 1.4.9 Insecure File Permissions
- CVE-2026-69665 — SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is e
- CVE-2026-78553 — Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
- CVE-2025-68825 — HCL Hive is affected by incorrect default permissions
- CVE-2026-18273 — Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability
- CVE-2026-58564 — Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privil
- CVE-2026-19893 — D-Link DIR-842 vsftpd vsftpd.conf default permission
- CVE-2026-19841 — TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission
- CVE-2026-63425 — During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Man
- CVE-2026-65940 — WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
- CVE-2026-48790 — turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
- CVE-2026-4793 — An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or wr
- CVE-2026-17497 — NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
- CVE-2026-16247 — Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN
- CVE-2026-16246 — Insecure permission assignment due to execution of LogPathConfig.exe during setup