CWE-278 Insecure Preserved Inherited Permissions
variantA product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (9)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-24747US | high8.8OT high | Exploit | ||
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actio… | ||||
| CVE-2025-2947US | critical9.8 | — | ||
IBM i 7.6
contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain r… | ||||
| CVE-2023-38497US | high7.3OT elevated | Exploit | ||
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when e… | ||||
| CVE-2019-14910US | critical9.8 | — | ||
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case… | ||||
| CVE-2026-6265US | high8.8 | — | ||
Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1 | ||||
| CVE-2024-37769US | high8.8 | — | ||
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request. | ||||
| CVE-2026-71477US | — | — | ||
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/in… | ||||
| CVE-2024-36538US | — | — | ||
Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. | ||||
| CVE-2024-38531US | — | — | ||
Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of t… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan