CWE-277 · Insecure Inherited Permissions
71 CVEs classified under CWE-277 (Insecure Inherited Permissions). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-36540 | Critical | 9.8 | 2024-07-24 | Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-36539 | Critical | 9.8 | 2024-07-24 | Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2021-41170 | Critical | 9.8 | 2021-11-08 | neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a… |
CVE-2026-7891 | Critical | 9.1 | 2026-05-07 | A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior o… |
CVE-2024-42681 | High | 8.8 | 2024-08-15 | Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. |
CVE-2024-36542 | High | 8.8 | 2024-07-25 | Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. |
CVE-2024-39877 | High | 8.8 | 2024-07-17 | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could exec… |
CVE-2024-6605 | High | 8.8 | 2024-07-09 | Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128. |
CVE-2023-27842 | High | 8.8 | 2023-03-21 | Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php comp… |
CVE-2024-34329 | High | 8.4 | 2024-07-22 | Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execu… |
CVE-2024-29417 | High | 8.4 | 2024-05-03 | Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function. |
CVE-2024-7143 | High | 8.3 | 2024-08-07 | A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAdd… |
CVE-2025-58437 | High | 8.1 | 2025-09-06 | Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be comp… |
CVE-2026-30266 | High | 7.8 | 2026-04-20 | Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file |
CVE-2024-27848 | High | 7.8 | 2024-06-10 | This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A malicious app may be able to… |
CVE-2024-27822 | High | 7.8 | 2024-05-14 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to gain root privileges. |
CVE-2024-23233 | High | 7.8 | 2024-03-08 | This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to this app may be used b… |
CVE-2023-33990 | High | 7.8 | 2023-07-11 | SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privil… |
CVE-2025-20008 | High | 7.7 | 2025-05-13 | Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to potentially enable esc… |
CVE-2024-41601 | High | 7.5 | 2024-07-19 | Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserContr… |