CWE-276: Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Consequences

• Confidentiality, Integrity: Read Application Data, Modify Application Data

How to prevent it

• Architecture and Design, Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
• Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Recent advisories

• CVE-2026-87886 — Local privilege escalation due to insecure file permissions.
• GHSA-6x7x-gcmf-7r8x — YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
• GHSA-rwp6-7w3q-75fq — OpenClaw: Config recovery could restore openclaw.json with broad file permissions
• GHSA-534h-c3cw-v3h9 — Nuxt dev server vite-node IPC socket is world-connectable on Linux
• GHSA-99qx-5qqr-4j95 — Apache ActiveMQ has an Incorrect Default Permissions vulnerability
• GHSA-q5f5-3gjm-7mfm — Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool
• GHSA-vr7j-g7jv-h5mp — OpenClaw session transcript files were created without forced user-only permissions
• GHSA-crjq-wm6x-6qx7 — .NET Elevation of Privilege Vulnerability
• GHSA-9hh7-6558-qfp2 — Mattermost allows other users to determine when users had read channels via channel member objects
• GHSA-rrpj-r8h7-rm7r — Apache DolphinScheduler Incorrect Default Permissions Vulnerability
• GHSA-jj2r-455p-5gvf — filebrowser Sets Insecure File Permissions
• GHSA-7w6r-748w-mh52 — pgAdmin has Incorrect Default Permissions
• GHSA-27vq-hv74-7cqp — SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type
• GHSA-qpgc-w4mg-6v92 — MLflow's excessive directory permissions allow local privilege escalation
• GHSA-fhg2-r2h9-h7q8 — Moodle IDOR when deleting OAuth2 linked accounts

All advisories for CWE-276