CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreMDM Server Registration Overriding9.3 Critical
- dräger protector softwareDräger Protector Software Local Privilege Escalation via Insecure File Permissions8.3 High
- dräger protector softwareDräger Protector Software Local Privilege Escalation via Insecure File Permissions8.3 High
- amazon kiro ideKiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths8.6 High
- fsas technologies inc. serverview agents for windowsIncorrect permission assignment for critical resource issue exists in ServerView Agents for...8.5 High
- suprema biostar 2 (server)Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar10.0 Critical
- asus system control interfaceAn Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control...7.3 High
- asus armoury crateIncorrect permission assignment for a critical resource in Armoury Crate allows a local user to...7.3 High
- acer nitrorsense v3NitroSense V3: Security Vulnerability Information8.5 High
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource6.3 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- genetec inc. rabbitmq, airport operational manager, industrial iot +4 more +6 moreA high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege...7.8 High
- bingos archive::tar, archive\ \, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory7.5 High
- acer nitrorsense v3NitroSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
- steipete summarizeSummarize < 0.15.1 Insecure File Permissions Information Disclosure6.8 Medium
- oalders www::mechanize::cached, www\ +1 moreWWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution5.3 Medium
- electermelecterm: Local code through electerm's single-instance socket9.3 Critical
- f5 big-ip, big-iq, big-ip access policy manager +21 more +23 moreiControl and tmsh REST vulnerability7.1 High
- f5 big-ip, big-iq, big-ip access policy manager +20 more +22 moreiControl REST and tmsh vulnerability7.1 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP iControl REST vulnerability5.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP tmsh vulnerability8.3 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreiControl REST and tmsh vulnerability7.1 High
- ivanti endpoint managerIncorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6...7.8 High
- ivanti secure access clientAn incorrect permission assignment for critical resource of Ivanti Secure Access Client before...4.4 Medium
- hikvision hik-connect appThe application does not impose strict enough restrictions on directory access permissions,...2.9 Low
- axis osA configuration file on the local file system had improper input validation which could allow...5.4 Medium
- axis osACAP applications can gain elevated privileges due to improper input validation during the...6.7 Medium
- pi-holePi-hole: Local privilege escalation via config-controlled path in root-executed service hooks8.8 High
- steipete summarizeSummarize Insecure Daemon Configuration File Permissions6.9 Medium
- acer predatorsense, predatorsense v3, nitrosense +2 morePredatorSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
@axonflow/openclawnpm@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening5.5 Medium- watchguard agentWatchGuard Agent on Windows Privilege Escalation Vulnerability7.3 High
- apache polarisApache Polaris: No protection on `write.metadata.path`9.4 Critical
- ilm informatique openconcertoIncorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique...2.4 Low
- anthropic claude sdk for typescript, anthropics anthropic-sdk-typescript +1 moreClaude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool4.8 Medium
- uutils coreutilsuutils coreutils nohup Information Disclosure via Insecure Default Output Permissions3.3 Low
- uutils coreutilsuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems3.4 Low
- uutils coreutilsuutils coreutils mkdir Permission Exposure Race Condition with -m3.3 Low
- uutils coreutilsuutils coreutils mkfifo Unauthorized Permission Change on Existing Files7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreNano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions2.5 Low
- freebsdMissing large page handling in pmap_pkru_update_range()6.2 Medium
- canonical canonical-livepatch, livepatch client +1 moreExposed Session Token in canonical-livepatch client snap5.7 Medium
- barracuda networks rmmBarracuda RMM < 2025.2.2 Privilege Escalation via Insecure Directory Permissions8.5 High
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection9.1 Critical
- grafana, grafana correlations +1 moreGrafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record3.3 Low
- samsung android, samsung mobile devices +1 moreIncorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1...5.4 Medium
- rapid7 insight agentInsight Agent Private Key Information Disclosure via Inherited File Permissions6.8 Medium
- openclawOpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image6.0 Medium
- dell powerprotect agent, powerprotect data manager +1 moreDell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission...3.3 Low
- openclawOpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration6.3 Medium
- Show moreLoading…