CWEweakness
CWE-281 Improper Preservation of Permissions
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Common consequences
• Confidentiality, Integrity: Read Application Data, Modify Application Data
Observed examples
• CVE-2002-2323: Incorrect ACLs used when restoring backups from directories that use symbolic links.
• CVE-2001-1515: Automatic modification of permissions inherited from another file system.
• CVE-2005-1920: Permissions on backup file are created with defaults, possibly less secure than original file.
• CVE-2001-0195: File is made world-readable when being cloned.
Related
Observed example · CVE (4)
- CVE-2005-1920 The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were… vulnerability
- CVE-2002-2323 Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and… vulnerability
- CVE-2001-1515 Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS… vulnerability
- CVE-2001-0195 sash before 3.4-4 in Debian GNU/Linux does not properly clone /etc/shadow, which makes it world-readable and could allow local users to… vulnerability
Child of · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
Referenced by CVE · weakness (350)
- CVE-2025-10149 The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. vulnerability
- CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. vulnerability
- CVE-2026-47489 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be… vulnerability
- CVE-2026-47595 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only… vulnerability
- CVE-2026-47596 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only… vulnerability
- CVE-2026-47599 NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause… vulnerability
- CVE-2026-93658 uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing… vulnerability
- CVE-2026-61709 OpenFGA is an authorization and permission engine built for developers. vulnerability
- CVE-2026-82964 Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker… vulnerability
- CVE-2026-88922 The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling… vulnerability
- CVE-2026-88016 rclone is a command-line program to sync files and directories to and from different cloud storage providers. vulnerability
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private vulnerability
- CVE-2025-14779 The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. vulnerability
- CVE-2026-23556 When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. vulnerability
- CVE-2026-58494 Wasmtime is a runtime for WebAssembly. vulnerability
- CVE-2026-4360 In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. vulnerability
- CVE-2026-44947 A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to… vulnerability
- CVE-2026-40767 Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions. vulnerability
- CVE-2024-47270 Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and… vulnerability
- CVE-2026-24194 NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission… vulnerability
- CVE-2026-44832 Snipe-IT is an IT asset/license management system. vulnerability
- CVE-2026-39828 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently… vulnerability
- CVE-2026-39832 When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. vulnerability
- CVE-2026-25850 in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak vulnerability
- CVE-2026-34600 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. vulnerability
- CVE-2026-34744 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability
- CVE-2025-8325 The software fails to enforce role-based access controls for certain Gateway API invocations. vulnerability
- CVE-2026-35350 The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. vulnerability
- CVE-2026-35351 The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. vulnerability
- CVE-2026-35361 The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux… vulnerability
Referenced by OWASP · mapped cwe (1)
- A01:2025 Broken Access Control Top 10 2025