CWE-276 vulnerabilities

CVE-2026-92252 is a vulnerability in WatchDog Anti-Virus for Windows where the installation directory has incorrect default permissions. The installer grants the Users group Full Control over the installation folder, allowing local low-privileged users to modify, replace, or delete antivirus binaries and configuration files. This can potentially disable antivirus protection or enable privileged code execution if modified binaries are loaded by an elevated process.

CVE-2026-87886 is a local privilege escalation vulnerability in Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin on Linux. It is caused by insecure file permissions allowing an attacker with limited privileges to escalate to higher privileges. The issue affects versions before build 1.9.3.1021 for cPanel & WHM, 1.8.11.638 for Plesk, and 1.2.3.238 for DirectAdmin. A fix is available in these builds. The vulnerability has a high severity score of 7.8 and is known to be exploited in the wild.

Dell Repository Manager versions prior to 3.5.2 have an incorrect default permissions vulnerability that allows a low privileged remote attacker to potentially elevate privileges. This vulnerability is identified as CWE-276 and has a high severity with a CVSS score of 8.5.

Nextflow versions from 25.09.2-edge up to but not including 25.10.6, and from 25.11.0-edge up to but not including 26.04.3, improperly set default file permissions when writing Seqera Platform OIDC bearer tokens to seqera-auth.config. This allows local users on multi-user POSIX systems who can traverse the victim's home directory to read the token file and impersonate the victim within the token's scope. Single-user systems and headless CI runners not using interactive login are not affected. The issue is fixed in versions 25.10.6 and 26.04.3.

In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent (re)starts, the agent reuses it based only on an existence and/or file-type check, without validating its owner or permissions. A local, unprivileged user with write access to the same base directory (by default under `$TMPDIR/ankaios`, e.g. shared `/tmp`) can pre-create this path hierarchy, including the two Control Interface FIFOs, before the agent starts. The agent then treats the attacker-owned FIFOs as the legitimate Control Interface for the targeted workload. The attacker can complete the Control Interface handshake and issue requests using that workload's configured `controlInterfaceAccess` permissions, allowing impersonation of the workload and, depending on its configured permissions, unauthorized reading and/or modification of the cluster's desired state.

CVE-2026-11813 is a high-severity vulnerability in the Lenovo FileZ Client application involving incorrect default permissions. This flaw could allow a local authenticated user to escalate their privileges on the affected system. The vulnerability affects versions prior to 11.7.1.0 and 11.5.1.0. No known exploits are reported in the wild, and no official patch information is provided in the available data.

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.

A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.

CVE-2026-18273 is a local privilege escalation vulnerability in the Kenwood DNR1007XR device due to incorrect default permissions on a USB filesystem mount point directory. An attacker with low-privileged code execution and physical access can exploit this flaw to escalate privileges to root and execute arbitrary code. The affected version is 1.7.0003.1000. The vulnerability has a CVSS 3.0 score of 6.6, indicating medium severity.

Dell Command Update (DCU) versions prior to 5.7.1 have an incorrect default permissions vulnerability (CWE-276). This flaw allows a low privileged local attacker to gain unauthorized filesystem access. The vulnerability has a high severity with a CVSS score of 7.8. No explicit patch links are provided, but versions 5.7.1 and later are not affected.

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

CVE-2026-48790 is a vulnerability in turso-cli versions prior to 1.0.26 where the user's Turso platform JWT is stored with incorrect default file permissions (0o644) in settings.json. This makes the credential file world-readable on Linux and macOS systems, allowing any local user to read the file and obtain the JWT, which grants full access to the user's Turso platform organizations. The issue is fixed in version 1.0.26.

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

CVE-2026-21074 is a high-severity vulnerability in Samsung Mobile's Bixby prior to version 4.0.86.0. It involves incorrect default permissions that allow local attackers with limited privileges to execute arbitrary commands with Bixby-level privileges. This vulnerability does not require user interaction and has a high impact on confidentiality and integrity. No official patch or remediation guidance is currently confirmed from the vendor.

NoteGen versions prior to 0.32.0 include a vulnerability where the Tauri shell plugin grants shell:allow-execute capability for bash, python, and python3 with arbitrary arguments by default. This allows JavaScript running in the application's webview to execute operating system commands with the privileges of the NoteGen process. If an attacker can execute scripts in the webview (e.g., via cross-site scripting), they can achieve full remote code execution on the user's machine.