CWE-277 is the weakness class for insecure inherited permissions. It describes cases where an object, record, file, or role inherits access rights from a parent, template, or default configuration, and that inherited access is broader than intended. The result is often a mismatch between the security model a developer expects and the effective permissions enforced by the platform.
This matters because inherited permissions can quietly expose sensitive data or allow actions that should be blocked. Attackers look for weak inheritance paths such as overly permissive parent ACLs, default roles, or platform rules that cannot be narrowed by child settings. Defenders should review the final, effective permissions rather than only the local rule on each object. The safest approach is least privilege: define access explicitly, test inheritance behavior in the runtime, and audit anonymous or broad roles that may expand access across the application.