CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- freebsd, netbsd netbsdNetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure6.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 morePcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token6.5 Medium
- rapid7 velociraptorVelociraptor Required Permissions bypass by using client monitoring queries9.9 Critical
- tubitak bilgem software technologies research institute pardus lightdm greeterImproper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter7.1 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.5 Medium
- passmark software burnintest, osforensics, performancetest +2 morePassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys8.5 High
- openvpnOpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated...1.8 Low
- insyde software insydeh2oSysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege6.5 Medium
- elastic agentIncorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM7.8 High
- kimaiKimai before 2.63.0 Authorization Bypass via Team Access Endpoints5.3 Medium
- cyber-iii student-management-systemsambitraj Student-Management-System session_start cookie httponly flag6.3 Medium
- composerComposer: CVE-2026-59946 fix bypass via symlinked package bin path6.1 Medium
- spring integration, vmware spring integration +1 moreWorld-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)3.2 Low
- johnson controls t2000T2000 open debug port5.2 Medium
- ransomlookInsecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook7.0 High
- remote utilities pte. ltd. utilities hostLocal Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.07.3 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack8.7 High
- kenwood dnr1007xrKenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.8 High
- splunk ai toolkitIncorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit8.1 High
- splunk enterprise securityPrivilege Escalation through Search Macro Permissions in Splunk Enterprise Security8.1 High
- splunk nmap scannerIncorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR6.6 Medium
- splunk fireampIncorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR2.7 Low
- splunk, splunk enterprise, secure gateway +2 moreInsecure Default Access Control List through the REST API in Splunk Secure Gateway5.3 Medium
- splunk, splunk enterprise +1 moreIncorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise6.5 Medium
- patriksimek vm2vm2 before 3.11.6 Process-wide State Exposure via os and dns10.0 Critical
- acer planet9 background servicePlanet9 Incorrect Permission Assignment Vulnerability Information8.5 High
- freepbx backupFreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module8.6 High
- northebridge luminalshineNortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure Permissions6.3 Medium
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.6.8 Medium
- autodesk installerIncorrect Permission Assignment in Autodesk Installer Named Pipes7.8 High
- amd power design manager (pdm) software installer for windowsIncorrect directory permissions could allow a local user to escalate their privileges,...7.0 High
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability7.8 High
- amd vitis™ embedded single file download (sfd) for windowsWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a...7.3 High
- siemens license server (sls)A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The...8.3 High
- axis communications ab osA VAPIX API parameter had improper input validation which could allow code execution and...7.2 High
- rclonerclone before 1.74.4 Privilege Escalation via setuid Metadata2.0 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreLibvirt: information disclosure via world-readable storage volume images during clone/convert5.5 Medium
- wellbia xigncode3CVE-2026-154306.2 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 moreAnsible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions5.5 Medium
- activepiecesActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache9.3 Critical
- apple ipados, macos, visionos +2 more +4 moreA permissions issue was addressed with improved validation. This issue is fixed in iOS 26.6 and...5.5 Medium
- weintek cmt3092x firmware, easyweb +1 moreWeintek cMT3092X Incorrect Permission Assignment for Critical Resource8.7 High
- duplicatiDuplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability7.8 High
- oracle e-business suite, succession planning +1 moreVulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component:...6.3 Medium
- oracle agile engineering data managementVulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain ...9.4 Critical
- oracle commerce guided search platform servicesVulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce ...9.1 Critical
- oracle solarisVulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The...7.1 High
- hewlett packard enterprise (hpe) edgeconnect sd-wan gateway (ecos)Authenticated Path Traversal allows Unauthorized Access in Web Interface7.2 High
- gitea open source git serverMissing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in c…5.9 Medium
- filegatorFileGator privilege escalation8.4 High
- Show moreLoading…