CWE-281 Improper Preservation of Permissions

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

Kata Container to Guest micro VM privilege escalation

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)

Duplicate Advisory: uutils coreutils has an Improper Preservation of Permissions issue

mkfifo: permissions of an existing file are changed after FIFO creation fails

Snipe-IT has Privilege Escalation via API Permissions Assignment

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries

Rancher user retains access to clusters despite Global Role removal

snowflake-sdk may incorrectly validate temporary credential cache file permissions

Object state limitation has no effect

Duplicate Advisory: GHSA-x698-5hjm-w2m5

Missing permission checks on Hazelcast client protocol

Improper Preservation of Permissions in xxl-job

Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled

Apache Airflow Improper Preservation of Permissions vulnerability

RuoYi vulnerable to Denial of Service by attackers with admin privileges

Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki

gix-worktree-state nonexclusive checkout sets executable files world-writable

Insecure default config access in WriteFreely