CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- qnap systems inc. notes station 3**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process8.5 High
- qnap systems inc. download stationds-move-files.sh is writable and executed as root8.4 High
- opensuse tumbleweed, suse opensuse leap 16.1, linux enterprise server 16.1 +1 more +3 moresdbootutil: world-readable debug log6.9 Medium
- progress moveit transferMOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation8.8 High
- giteaGitea local code execution through writable Git hooks5.8 Medium
- okta radius agentInsecure Default File Permissions in Okta RADIUS Agent Windows Installer5.3 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +8 more +10 moreWindows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Mobile Broadband Elevation of Privilege Vulnerability7.8 High
- hammock corporation assetview, assetview cloud, assetview cloud + +2 moreAn incorrect permission assignment for critical resource issue exists in AssetView, AssetView...8.5 High
- codefori vscode-ibmiCode for IBMi: Uses IBM i components with blind check allowing arbitrary code execution8.9 High
- progress software corporation marklogic serverIncorrect log file permissions in Progress MarkLogic Server7.1 High
- edgelesssys contrastEdgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation8.5 High
- freerdpFreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert6.8 Medium
- freerdpFreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File4.1 Medium
- genspark-ai genofficeGenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store6.8 Medium
- devolutions server, mariadb +1 moreMariaDB: Insecure $HOME in MariaDB rpm packages8.4 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...6.3 Medium
- glavsoft tightvncWorld-accessible IPC shared memory with predictable name in TightVNC Server7.8 High
- brocade fabric os, broadcom fabric operating system +1 moreAn improper file permission and missing authorization vulnerability exists in the diagnostic...7.0 High
- splunk, splunk enterprise, secure gateway +2 moreIncorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway6.3 Medium
- giteaGitea tag delete route deletes releases without release permission8.1 High
- dell system updateDell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for...8.2 High
- @quasar app-vite, cli, ssl-certificate +1 more +3 moreQuasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions8.4 High
- devopspolis secrets-replicatordevopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment5.3 Medium
- nrwl nxNx daemon and plugin worker sockets are accessible to other local users8.5 High
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure...6.0 Medium
- viidure dashcam android applicationIncorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application8.7 High
- cthackers adm-zipadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation7.1 High
- ibm iIBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []7.8 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...7.8 High
- abb protection and control ied manager (pcm600)Improper Permission Assignment in Scheduler Service7.1 High
- invoiceplaneInvoicePlane: Remote Code Execution via Writable Templates Directory9.1 Critical
- dell trusted device client,Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission...7.1 High
- webpros cpanelIncorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information...8.2 High
- tauri tauri-plugin-dialogTauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion7.7 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor installer local privilege escalation8.8 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader Updater Privilege Escalation8.8 High
- apache http server project lounge windowsCVE-2026-892818.4 High
- apache http server project lounge windowsCVE-2026-892829.1 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Insecure File Permissions on OAuth Token Storage5.5 Medium
- mispMISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials6.9 Medium
- dell command | monitor (dcm)Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission...8.4 High
- synology diskstation manager (dsm)An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology...8.8 High
- microsoft 365 copilotM365 Copilot Information Disclosure Vulnerability7.7 High
- patriksimek vm2vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation10.0 Critical
- dell objectscaleDell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for...5.5 Medium
- duplicatiDuplicati for Windows - Incorrect Permission Assignment for Critical Resource7.0 High
- apple ipados, macos, ios and ipados +1 more +3 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7...5.5 Medium
- mistralai mistral-vibeAn arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace...10.0 Critical
- Show moreLoading…