CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- gitleaks Gitleaks through 8.30.1 World-Readable Report Files via --report-path 4.8 Medium
- tinyhumansai openhuman OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive) 8.8 High
- shenzhen shine industrial co., ltd. vitafit VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure 8.7 High
- quest foglight for databases Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability 7.8 High
- avaya system manager CVE-2026-16305 7.8 High
- postgresql psqlodbc psqlODBC log files are created with default permissions at a predictable path and follow symbolic links 5.3 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment... 5.5 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment... 5.5 Medium
- mediatek, inc. mediatek chipset In Modem, there is a possible escalation of privilege due to a permissions bypass. This could... 6.7 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment... 5.5 Medium
- No product listed Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make... 9.1 Critical
- No product listed Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode... 9.1 Critical
- No product listed Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows... 7.5 High
- No product listed Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to... 7.5 High
- No product listed Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62)... 9.1 Critical
- No product listed Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized... 7.5 High
- No product listed Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows... 7.5 High
- No product listed Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root... 7.5 High
- No product listed Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an... 9.1 Critical
- No product listed Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers... 7.5 High
- No product listed Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to... 7.5 High
- No product listed Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized... 6.5 Medium
- No product listed Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized... 8.1 High
- tox-dev filelock filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold 5.3 Medium
- tox-dev filelock filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL 5.3 Medium
- drupal s3 file system S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 5.6 Medium
- juniper networks session smart conductor Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials 6.8 Medium
- gnupg CVE-2026-118131 9.8 Critical
- watchguard fireware os Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root 7.2 High
- nagios host, teamviewer full client +1 more Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows 7.8 High
- apple macos This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,... 7.1 High
- apple macos A permissions issue was addressed with additional restrictions. This issue is fixed in macOS... 5.5 Medium
- apple macos A permissions issue was addressed with additional restrictions. This issue is fixed in macOS... 7.1 High
- boneio black debian images Incorrect Permission Assignment for Critical Resource in boneIO 6.8 Medium
- zimbra collaboration suite Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration 7.8 High
- zimbra collaboration suite Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions 7.8 High
- cgm clininet Local Privilege Escalation in CGM CLININET 9.3 Critical
- cgm clininet Insecure File Permissions in CGM CLININET 6.8 Medium
- watchguard agent WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering 7.3 High
- watchguard agent Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File 6.9 Medium
- nomachine NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability 7.8 High
- cisco telepresence video communication server (vcs) expressway Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities 7.8 High
- cthackers adm-zip Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits 6.9 Medium
- pypa virtualenv virtualenv: Seeded files retain permissions from an older cache 4.4 Medium
- dell application store Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment... 7.0 High
- electronic arts ea javelin anticheat (ea javelin anticheat installer) EA Javelin Anticheat Installer Local Privilege Escalation 5.0 Medium
- ubports lomiri-download-manager Incorrect Permission Assignment for Critical Resource in lomiri-download-manager 5.5 Medium
- ubports lomiri-download-manager Incorrect Permission Assignment for Critical Resource in lomiri-download-manager 7.8 High
- apache software foundation airflow keycloak provider Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read 6.5 Medium
- asynchttpclient async-http-client AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink 5.8 Medium
- Show olderLoading…