CWEweakness
CWE-277 Insecure Inherited Permissions
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Common consequences
• Confidentiality, Integrity: Read Application Data, Modify Application Data
Potential mitigations
• [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
• [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Observed examples
• CVE-2005-1841: User's umask is used when creating temp files.
• CVE-2002-1786: Insecure umask for core dumps [is the umask preserved or assigned?].
Related
Observed example · CVE (2)
- CVE-2005-1841 The control for Adobe Reader 5.0.9 and 5.0.10 on Linux, Solaris, HP-UX, and AIX creates temporary files with the permissions as specified… vulnerability
- CVE-2002-1786 SGI IRIX 6.5 through 6.5.14 applies a umask of 022 to root core dumps, which allows local users to read the core dumps and possibly obtain… vulnerability
Child of · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
Referenced by CVE · weakness (71)
- CVE-2025-11395 A flaw was found in Podman. vulnerability
- CVE-2026-9046 A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed… vulnerability
- CVE-2026-30266 Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a… vulnerability
- CVE-2026-20630 A permissions issue was addressed with additional restrictions. vulnerability
- CVE-2025-32092 Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Applications may allow… vulnerability
- CVE-2025-37174 Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10… vulnerability
- CVE-2025-65111 SpiceDB is an open source database system for creating and managing security-critical application permissions. vulnerability
- CVE-2025-64185 Open OnDemand is an open-source HPC portal. vulnerability
- CVE-2025-24327 Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application before version 20.0.1021 within Ring 3: User… vulnerability
- CVE-2025-11554 A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. vulnerability
- CVE-2025-56019 An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to… vulnerability
- CVE-2025-58437 Coder allows organizations to provision remote development environments via Terraform. vulnerability
- CVE-2025-9039 We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by… vulnerability
- CVE-2025-36104 IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure… vulnerability
- CVE-2025-32797 Conda-build contains commands and tools to build conda packages. vulnerability
- CVE-2025-3473 IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions… vulnerability
- CVE-2018-25111 django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. vulnerability
- CVE-2025-20008 Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to… vulnerability
- CVE-2025-20629 Insecure inherited permissions in the NVM Update Utility for some Intel(R) Ethernet Network Adapter E810 Series before version 4.60 may… vulnerability
- CVE-2025-22448 Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an authenticated user… vulnerability
- CVE-2025-31332 Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system… vulnerability
- CVE-2025-29982 Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. vulnerability
- CVE-2023-28207 The issue was addressed with improved checks. vulnerability
- CVE-2024-51448 IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. vulnerability
- CVE-2024-36276 Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially… vulnerability
- CVE-2024-36294 Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially… vulnerability
- CVE-2024-45599 Cursor is an artificial intelligence code editor. vulnerability
- CVE-2024-42681 Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. vulnerability
- CVE-2024-23908 Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an… vulnerability
- CVE-2024-25561 Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user… vulnerability