Skip to content
Log inStart free trial

CWE-281: Improper Preservation of Permissions

Base

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Consequences

  • Confidentiality, Integrity: Read Application Data, Modify Application Data

Recent advisories

  • GHSA-g3pg-frfm-pr2m — OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
  • GHSA-f8g7-2xjc-7mfh — rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
  • GHSA-q423-49rw-g9mh — Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
  • GHSA-4ch3-9j33-3pmj — Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
  • GHSA-f5wc-c3c7-36mc — golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
  • GHSA-45gg-vh54-h5m9 — golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
  • GHSA-rmp5-5jj7-gmvf — MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
  • GHSA-hq28-crg7-95pr — Snipe-IT has Privilege Escalation via API Permissions Assignment
  • GHSA-957r-r8gc-vv3h — uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries
  • GHSA-x2wv-9p67-mh9w — uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails
  • GHSA-j4vr-pcmw-hx59 — Rancher user retains access to clusters despite Global Role removal
  • GHSA-x698-5hjm-w2m5 — pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
  • GHSA-hrxh-9w67-g4cv — Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata
  • GHSA-v994-f8vw-g7j4 — `docker cp` allows unexpected chmod of host files in Moby Docker Engine
  • GHSA-w2v8-php4-p8hc — Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

All advisories for CWE-281

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor