Incorrect Default Permissions
A flaw in grub2 was found where its configuration file, known as "grub.cfg", is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can eventually read any encrypted passwords present in "grub.cfg". This issue has been fixed in grub upstream but no version with the fix is currently released.
CWE-276 - Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.