CWE-281Improper Preservation of Permissions

Abstraction: Base · CVEs in our corpus: 339

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Last updated: 20 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 3 mapping(s) from 2 framework(s): STIG windows server 2022 2 (partial) · STIG windows server 2019 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PS-5 Personnel Transfer
PR.AA-05
AC-3 Access Enforcement
AC-6 Least Privilege

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

8 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`PS-5`	Personnel Transfer	PS	Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2017-8543` KEV	9.9	9.8	0.6486	2017-06-15
`CVE-2017-8589`	8.7	9.8	0.2616	2017-07-11
`CVE-2019-0233`	8.3	7.5	0.6805	2020-09-14
`CVE-2021-33990`	8.3	9.8	0.1192	2023-04-16
`CVE-2018-4115`	7.7	9.8	0.0225	2018-04-03
`CVE-2020-18890`	7.6	9.8	0.0152	2021-05-06
`CVE-2021-29971`	7.5	9.8	0.0102	2021-08-05
`CVE-2020-36070`	7.5	9.8	0.0108	2023-04-26
`CVE-2023-47463`	7.5	9.8	0.0128	2023-11-30
`CVE-2024-54465`	7.5	9.8	0.0088	2024-12-12
`CVE-2024-56973`	7.5	9.8	0.0090	2025-02-14
`CVE-2023-28668`	7.4	9.8	0.0083	2023-04-02
`CVE-2023-34034`	7.4	9.1	0.0398	2023-07-19
`CVE-2024-36532`	7.4	10.0	0.0045	2024-06-21
`CVE-2024-41644`	7.4	9.8	0.0068	2024-12-06
`CVE-2024-41645`	7.4	9.8	0.0068	2024-12-06
`CVE-2024-41646`	7.4	9.8	0.0068	2024-12-06
`CVE-2024-41649`	7.4	9.8	0.0068	2024-12-06
`CVE-2024-55507`	7.4	9.8	0.0061	2025-01-03
`CVE-2024-46622`	7.4	9.8	0.0059	2025-01-06
`CVE-2024-41648`	7.3	9.8	0.0048	2024-12-06
`CVE-2024-41650`	7.3	9.8	0.0047	2024-12-06
`CVE-2024-46310`	7.3	9.1	0.0248	2025-01-13
`CVE-2025-55130`	7.2	9.1	0.0166	2026-01-20
`CVE-2020-10083`	7.1	9.1	0.0108	2020-03-13