CWE-281Improper Preservation of Permissions

Abstraction: Base · CVEs in our corpus: 349

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Last updated: 15 October 2026 10:21 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 1 mapping(s) from 1 framework(s): STIG windows server 2019 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PS-5 Personnel Transfer
PR.AA-05
AC-3 Access Enforcement
AC-6 Least Privilege

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

5 hardening rules · 2 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`PS-5`	Personnel Transfer	PS	Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2017-8543` KEV	9.9	9.8	0.7416	2017-06-15
`CVE-2017-8589`	8.7	9.8	0.2616	2017-07-11
`CVE-2019-0233`	8.3	7.5	0.6615	2020-09-14
`CVE-2021-33990`	8.3	9.8	0.1192	2023-04-16
`CVE-2018-4115`	7.7	9.8	0.0221	2018-04-03
`CVE-2020-18890`	7.6	9.8	0.0152	2021-05-06
`CVE-2021-29971`	7.5	9.8	0.0102	2021-08-05
`CVE-2020-36070`	7.5	9.8	0.0108	2023-04-26
`CVE-2023-47463`	7.5	9.8	0.0128	2023-11-30
`CVE-2024-54465`	7.5	9.8	0.0090	2024-12-12
`CVE-2024-56973`	7.5	9.8	0.0090	2025-02-14
`CVE-2023-28668`	7.4	9.8	0.0083	2023-04-02
`CVE-2023-34034`	7.4	9.1	0.0398	2023-07-19
`CVE-2024-36532`	7.4	10.0	0.0045	2024-06-21
`CVE-2024-41644`	7.4	9.8	0.0070	2024-12-06
`CVE-2024-41645`	7.4	9.8	0.0070	2024-12-06
`CVE-2024-41646`	7.4	9.8	0.0070	2024-12-06
`CVE-2024-41649`	7.4	9.8	0.0070	2024-12-06
`CVE-2024-55507`	7.4	9.8	0.0063	2025-01-03
`CVE-2024-46622`	7.4	9.8	0.0061	2025-01-06
`CVE-2024-41648`	7.3	9.8	0.0048	2024-12-06
`CVE-2024-41650`	7.3	9.8	0.0048	2024-12-06
`CVE-2024-46310`	7.3	9.1	0.0248	2025-01-13
`CVE-2025-55130`	7.2	9.1	0.0172	2026-01-20
`CVE-2020-10083`	7.1	9.1	0.0108	2020-03-13