CWE-277 Insecure Inherited Permissions
Description
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-277 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-7f3r-gwc9-2995 | CVE-2026-44836 | MODERATE |
view_component: Preview Route Can Dispatch Inherited Helper Methods |
2026-06-08 | |
| GHSA-q3jj-46pq-826r | CVE-2026-44997 | MODERATE |
OpenClaw's ACP child sessions inherit subagent security envelope constraints |
2026-05-19 | |
| GHSA-9m7r-g8hg-x3vr | CVE-2025-65111 | LOW |
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results |
2026-05-14 | |
| GHSA-9m5j-4xx9-44j9 | CVE-2024-7143 | HIGH |
Pulp incorrectly assigns RBAC permissions in tasks that create objects |
2026-03-20 | |
| GHSA-j6xf-jwrj-v5qp | CVE-2025-58437 | HIGH |
Coder vulnerable to privilege escalation could lead to a cross workspace compromise |
2025-09-10 | |
| GHSA-wm7x-ww72-r77q | CVE-2025-9039 | MODERATE |
Information Disclosure in Amazon ECS Container Agent |
2025-08-14 | |
| GHSA-m4jx-m5hg-qrxx | CVE-2018-25111 | MODERATE |
django-helpdesk Allows Sensitive Data Exposure |
2025-06-04 | |
| GHSA-cpfp-m5qw-c4r3 | CVE-2024-42681 | HIGH |
Improper Preservation of Permissions in xxl-job |
2025-05-22 | |
| GHSA-g5hv-r743-v8pm | CVE-2024-39877 | HIGH |
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler |
2025-01-21 | |
| GHSA-mf7c-35mq-75pj | CVE-2016-6811 | HIGH |
Insecure Inherited Permissions in Apache Hadoop |
2022-07-06 | |
| GHSA-3v56-q6r6-4gcw | CVE-2021-41170 | HIGH | - |
Insecure Inherited Permissions in neoan3-apps/template |
2021-11-08 |