CWE-278: Insecure Preserved Inherited Permissions

What is CWE-278?

CWE-278 is Insecure Preserved Inherited Permissions. The flaw arises when a product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.

Analyzing data...

OWASP Top 10 Rank-
Related CVES (365 days)-
AbstractionVariant
Likelihood of exploit-

No data

No vulnerability data for CWE-278

No data

No vulnerability data in CISA KEV for CWE-278

Official definition

ByMitre CWE

A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.

Characteristics

Modes of introduction

  • Architecture and Design
  • Operation

Common consequences

ImpactScopeExplanation
Read Application Data, Modify Application DataConfidentiality, Integrity-

Risk mitigations

  1. Architecture and Design, OperationVery carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  2. Separation of Privilege · Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

Sources (2)
MITRE CWE
CWE Terms of Use

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan
More resources & insights

Explore more resources from CyStack

Website security reports

Review CyStack's security rating and practical recommendations for websites and edge assets.

Learn more

CyStack research

Explore cybersecurity research from our team of security specialists.

Learn more

Cybersecurity knowledge

Browse practical cybersecurity knowledge across CyStack's articles and guides.

Learn more