CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- egor data::disjointset::sharedData::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW4.0 Medium
- egor data::spatialhash::sharedData::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::intern::sharedData::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::ringbuffer::sharedData::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::roaringbitmap::sharedData::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW5.5 Medium
- egor data::hashmap::sharedData::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::radixtree::sharedData::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::sortedset::sharedData::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::reqrep::sharedData::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::pubsub::sharedData::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::ndarray::sharedData::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.3 Low
- egor data::graph::sharedData::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.3 Low
- egor data::deque::sharedData::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::buffer::sharedData::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW6.2 Medium
- craigjbass clearancekitClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy6.9 Medium
- hcl dfxanalytics, hclsoftware dfxserver, dfmpro for catia +2 moreThe HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions...3.3 Low
- cyberjunky python-garminconnectgarminconnect: Insecure Permission Assignment for Garmin OAuth Token Store8.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreSamba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation6.1 Medium
- openclawOpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback8.7 High
- openclawOpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install8.7 High
- mockoonMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft8.8 High
- composerComposer: Path traversal in package bin field lets dependencies chmod arbitrary host files6.1 Medium
- xhmikosr decompressdecompress: Archive extraction can create files and links outside the target directory9.1 Critical
- ciliumCilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access9.2 Critical
- tubitak bilgem software technologies research institute pardus-parental-controlDNS Hijacking in TUBITAK BILGEM's Pardus-Parental-Control8.8 High
- gitea open source git serverPermanent Fork PR Workflow Approval Gate Bypass8.9 High
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0...4.4 Medium
- watchguard mobile vpn with ssl client, mobile vpn with ssl, fireware +2 moreWatchGuard Mobile VPN with SSL Windows Client Local Privilege Escalation7.3 High
- aws cli, amazon aws command line interface +1 moreOverly permissive File Permissions in AWS CLI6.8 Medium
github.com/kahiteam/kahiGoKahi has privilege-drop and socket/log permission issuesNo score- nesquena hermes-webuiHermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import6.0 Medium
- apple ipados, macos, safari +5 more +7 moreThis issue was addressed through improved state management. This issue is fixed in Safari 26.5.2,...6.5 Medium
- tursodatabase turso-cliturso-cli persists Turso platform JWT with world-readable (0o644) file permissions5.5 Medium
- nextflow-io nextflowNextflow: Incorrect default permissions in the nextflow auth login command5.5 Medium
- schneider electric easylogic t150 (formerly saitel dr) remote terminal unit & controller, saitel dp remote terminal unit & controller, schneider-electric easylogic t150 firmware +1 more +3 moreCWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause...6.7 Medium
- jdx misemise: Arbitrary command execution via task-include files in an untrusted, config-less repository8.6 High
- amazon web services language servers for awsArbitrary Code Execution in Language Servers for AWS8.5 High
- motioneye-project motioneyemotionEye: World-Readable Configuration File Exposes Admin Password Hash5.5 Medium
- sentriz gonicgonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host8.1 High
- steeltoeoss steeltoe.configuration.abstractionsSteeltoe: TLS private keys written to /tmp with default permissions, never deleted4.7 Medium
- earendil-works piPi: Race condition in auth.json writes could expose stored credentials2.2 Low
- openclawOpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json5.7 Medium
- openclawOpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope7.1 High
- palo alto networks prisma access agentPrisma Access Agent: Local Privilege Escalation by Authorized Users5.9 Medium
- fissionFission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption8.5 High
- clash verge rev clash-verge-service-ipcclash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local...8.4 High
- siderolabs omniOmni: Reader-level users can retrieve imported cluster CA keys via ResourceService7.6 High
- mimecast incydrIn Mimecast Incydr before 2.6.0, arbitrary file access can occur.4.5 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...6.5 Medium
- red hat openshift pipelines, openshift builds 1.7.3, openshift builds 1.8.1 +2 moreOpenshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources7.1 High
- Show moreLoading…