CWE-276— Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.— MITRE CWE catalog

1,721 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-276page 28 of 35

CVE-2021-0979MEDIUMCVSS 5.5EG 5.5
2021-12-15
In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions bypass. This could lead to local informat…
CVE-2021-0672MEDIUMCVSS 5.5EG 5.5
2021-11-18
In Browser app, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.P…
CVE-2021-3720MEDIUMCVSS 5.5EG 5.5
2021-11-12
An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data.
CVE-2021-38379MEDIUMCVSS 5.5EG 5.5
2021-10-27
The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.
CVE-2021-0706MEDIUMCVSS 5.5EG 5.5
2021-10-22
In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User int…
CVE-2021-33923MEDIUMCVSS 5.5EG 5.5
2021-09-29
Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database).
CVE-2021-1832MEDIUMCVSS 5.5EG 5.5
2021-09-08
Copied files may not have the expected file permissions. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. The issue was addressed with improved permissions logi…
CVE-2021-1831MEDIUMCVSS 5.5EG 5.5
2021-09-08
The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may allow shortcuts to access restricted files.
CVE-2021-30750MEDIUMCVSS 5.5EG 5.5
2021-09-08
The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3. A malicious application may be able to access the user's recent contacts.
CVE-2021-31007MEDIUMCVSS 5.5EG 5.5
2021-08-24
Description: A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.1 and iPadOS 15.1, tvOS 15.1, macOS Big Sur 11.6.2, watchOS 8.1, macOS Monterey 12.1. A malicious application may be able to bypass Priv…
CVE-2021-31006MEDIUMCVSS 5.5EG 5.5
2021-08-24
Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 7.6, tvOS 14.7, macOS Big Sur 11.5. A malicious application may be able to bypass certain Privacy preferences.
CVE-2021-22295MEDIUMCVSS 5.5EG 5.5
2021-08-06
A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.
CVE-2021-0654MEDIUMCVSS 5.5EG 5.5
2021-07-14
In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. This could lead to local information disclosure from locked profiles with no additional execution privileges needed. User inter…
CVE-2021-0588MEDIUMCVSS 5.5EG 5.5
2021-07-14
In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not…
CVE-2021-20490MEDIUMCVSS 5.5EG 5.5
2021-06-29
IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID: 197791.
CVE-2020-9451MEDIUMCVSS 5.5EG 5.5
2021-05-25
An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged u…
CVE-2021-3451MEDIUMCVSS 5.5EG 5.5
2021-04-27
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-standard locations.
CVE-2021-30494MEDIUMCVSS 5.5EG 5.5
2021-04-14
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log fi…
CVE-2021-30493MEDIUMCVSS 5.5EG 5.5
2021-04-14
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log fil…
CVE-2021-0428MEDIUMCVSS 5.5EG 5.5
2021-04-13
In getSimSerialNumber of TelephonyManager.java, there is a possible way to read a trackable identifier due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interacti…
CVE-2021-25381MEDIUMCVSS 5.5EG 5.5
2021-04-09
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingInt…
CVE-2021-25355MEDIUMCVSS 5.5EG 5.5
2021-03-25
Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingIntent.
CVE-2021-0382MEDIUMCVSS 5.5EG 5.5
2021-03-10
In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local information disclosure with no additional execution privileges needed. User interacti…
CVE-2021-0381MEDIUMCVSS 5.5EG 5.5
2021-03-10
In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is no…
CVE-2020-8357MEDIUMCVSS 5.5EG 5.5
2021-03-09
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-standard locations.
CVE-2021-24031MEDIUMCVSS 5.5EG 5.5
2021-03-04
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writ…
CVE-2020-0524MEDIUMCVSS 5.5EG 5.5
2021-02-17
Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2020-26941MEDIUMCVSS 5.5EG 5.5
2021-01-26
A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of any file via a symlink, due to insecure permissions. The possibility of exploiting this vulnerability…
CVE-2020-27039MEDIUMCVSS 5.5EG 5.5
2020-12-15
In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for expl…
CVE-2020-0468MEDIUMCVSS 5.5EG 5.5
2020-12-14
In listen() and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permissions due to a missing permission check. This could lead to local information disclosure with no additional execution pri…
CVE-2020-24460MEDIUMCVSS 5.5EG 5.5
2020-11-12
Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2020-0453MEDIUMCVSS 5.5EG 5.5
2020-11-10
In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed …
CVE-2020-0448MEDIUMCVSS 5.5EG 5.5
2020-11-10
In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to …
CVE-2020-0437MEDIUMCVSS 5.5EG 5.5
2020-11-10
In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to local denial of service of emergency alerts with no additional execution privileges needed. User intera…
CVE-2020-0415MEDIUMCVSS 5.5EG 5.5
2020-10-14
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed f…
CVE-2020-0410MEDIUMCVSS 5.5EG 5.5
2020-10-14
In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
CVE-2020-26088MEDIUMCVSS 5.5EG 5.5
2020-09-24
A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.
CVE-2020-0316MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a missing permission check. This could lead to local information disclosure of radio data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Andr…
CVE-2020-0315MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Zen Mode, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0311MEDIUMCVSS 5.5EG 5.5
2020-09-18
In InputManagerService, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: A…
CVE-2020-0310MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0307MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0304MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0302MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi…
CVE-2020-0295MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telecom, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersio…
CVE-2020-0294MEDIUMCVSS 5.5EG 5.5
2020-09-18
In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction…
CVE-2020-0285MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0284MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0276MEDIUMCVSS 5.5EG 5.5
2020-09-18
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2020-0426MEDIUMCVSS 5.5EG 5.5
2020-09-17
In SyncManager, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: …

Map vulnerabilities like CWE-276 to your infrastructure

EchelonGraph correlates every CVE — across CWE-276 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →