CWE-278 · Access Control
Insecure Preserved Inherited Permissions
7CVEs
SortMost likely exploited
7 CVEs with CWE-278 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-38497Cargo not respecting umask when extracting crate archivesrust-lang · cargo · CVSS 7.8 · 2023-08-04 | 7.8 | 0.7% | 2023-08-04 |
| CVE-2024-36538Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.Chaos-Mesh · Chaos Mesh · CVSS 8.8 · 2024-07-24 | 8.8 | 0.6% | 2024-07-24 |
| CVE-2024-37769Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.B1ackc4t · 14finger · CVSS 8.8 · 2024-07-05 | 8.8 | 0.5% | 2024-07-05 |
| CVE-2025-2947IBM i privilege escalationIBM · i · CVSS 7.2 · 2025-04-17 | 7.2 | 0.5% | 2025-04-17 |
| CVE-2026-6265Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2Cerberus · Cerberus FTP Server · CVSS 7.3 · 2026-04-27 | 7.3 | 0.3% | 2026-04-27 |
| CVE-2024-38531Nix sandbox escapeNixOS · nix · CVSS 3.6 · 2024-06-28 | 3.6 | 0.1% | 2024-06-28 |
| CVE-2026-71477mise: Incorrect file ownership, when installed by the root user using `install.sh`jdx · mise · CVSS 6.7 · 2026-08-18 | 6.7 | 0.1% | 2026-08-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.