# CWE-278.

Every Advisory and CVE whose sources give the weakness CWE-278, newest first.

## Records, newest first

- [mise: Incorrect file ownership, when installed by the root user using \`install.sh\`](https://agentprime.io/advisories/CVE-2026-71477.md)
  `CVE-2026-71477` · CVE record: jdx mise · CVSS 6.7 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-278
- [Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2](https://agentprime.io/advisories/CVE-2026-6265.md)
  `CVE-2026-6265` · CVE record: Cerberus Cerberus FTP Server · CVSS 7.3 High · Not analysed yet · Published 27 Apr 2026 · Tags: CWE-278
- [IBM i privilege escalation](https://agentprime.io/advisories/CVE-2025-2947.md)
  `CVE-2025-2947` · CVE record: IBM i · CVSS 7.2 High · Not analysed yet · Published 17 Apr 2025 · Tags: CWE-278
- [Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.](https://agentprime.io/advisories/CVE-2024-36538.md)
  `CVE-2024-36538` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Jul 2024 · Tags: CWE-278
- [Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.](https://agentprime.io/advisories/CVE-2024-37769.md)
  `CVE-2024-37769` · CVE record · CVSS 8.8 High · Not analysed yet · Published 5 Jul 2024 · Tags: CWE-278
- [Nix sandbox escape](https://agentprime.io/advisories/CVE-2024-38531.md)
  `CVE-2024-38531` · CVE record: NixOS nix · CVSS 3.6 Low · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-278
- [Cargo not respecting umask when extracting crate archives](https://agentprime.io/advisories/GHSA-j3xp-wfr4-hx87.md)
  `GHSA-j3xp-wfr4-hx87`, `CVE-2023-38497` · crates.io `cargo`: affected `<0.72.2`, fixed in `0.72.2` · CVSS 7.8 High · Not analysed yet · Published 3 Aug 2023 · Tags: Broken access control, CWE-278
- [Keycloak Authentication Error](https://agentprime.io/advisories/GHSA-jf86-9434-f8c2.md)
  `GHSA-jf86-9434-f8c2`, `CVE-2019-14910` · Maven `org.keycloak:keycloak-parent`: affected `>=7.0.0, <=7.0.1`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-278, CWE-305

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-278>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-278/>. Everything for agents: <https://agentprime.io/llms.txt>.