cve.bz

CWE-732: Incorrect Permission Assignment for Critical Resource

Filter

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

What the weakness is: CWE-732 at MITRE

Ask an AI about CWE-732

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-732: Incorrect Permission Assignment for Critical Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/732.html and https://cve.bz/cve/cwe/732?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-68591

    In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for ex…

  2. 5.5CVE-2026-111499EPSS 0.1%

    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Prot…

  3. –CVE-2026-118574EPSS 0.1%

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

  4. 9.1CVE-2026-107060EPSS 0.3%

    Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

  5. 7.5CVE-2026-107055EPSS 0.3%

    Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.

  6. 7.5CVE-2026-107047EPSS 0.4%

    Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.

  7. 7.5CVE-2026-107044EPSS 0.3%

    Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.

  8. 7.5CVE-2026-107042EPSS 0.4%

    Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.

  9. 7.5CVE-2026-107039EPSS 0.5%

    Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).

  10. 7.5CVE-2026-107026EPSS 0.5%

    Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content.

  11. 6.5CVE-2026-107023EPSS 0.3%

    Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.

  12. 6.8CVE-2026-103404EPSS 0.2%

    An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tm…

  13. 7.8CVE-2026-92377EPSS 0.1%

    Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged…

  14. 7.2CVE-2026-90464EPSS 0.4%

    An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, …

  15. 6.8CVE-2026-77060EPSS 0.1%

    boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. …

  16. 7.8CVE-2026-93640EPSS 0.1%

    A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments t…

  17. 7.8CVE-2026-50057EPSS 0.3%

    A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix a…

  18. 9.3CVE-2025-30054EPSS 0.1%

    CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache us…

  19. 6.8CVE-2025-30051EPSS 0.10%

    The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account.  This iss…

  20. 6.9CVE-2026-96293EPSS 0.06%

    A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key…

  21. 7.3CVE-2026-115253EPSS 0.1%

    An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the dir…

  22. 7.8CVE-2026-111184EPSS 0.1%

    NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the abili…

  23. 7.8CVE-2026-76495EPSS 0.1%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening relea…

  24. 6.9CVE-2026-114105EPSS 0.1%

    Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file att…

  25. 4.4CVE-2026-113720EPSS 0.1%

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current…

  26. 7.0CVE-2026-71169EPSS 0.1%

    Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Discl…

  27. 5.0CVE-2026-96542EPSS 0.08%

    Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to…

  28. 5.5CVE-2026-96425EPSS 0.1%

    Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

  29. 7.8CVE-2026-96424EPSS 0.1%

    Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

  30. 6.5CVE-2026-92228EPSS 0.3%

    The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision team…

  31. 5.8CVE-2026-102740EPSS 0.1%

    The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictab…

  32. 8.4CVE-2026-34014EPSS 0.1%

    An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of …

  33. 8.5CVE-2026-34008EPSS 0.10%

    An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.…

  34. 6.9CVE-2026-104618EPSS 0.1%

    On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secret…

  35. 8.8CVE-2026-87093EPSS 0.2%

    Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

  36. 5.8CVE-2026-70402EPSS 0.2%

    Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify …

  37. 5.3CVE-2026-78632EPSS 0.07%

    The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions a…

  38. 7.8CVE-2026-97800EPSS 0.3%

    Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.

  39. 7.8CVE-2026-97792EPSS 0.3%

    Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

  40. 8.5CVE-2026-101020EPSS 0.1%

    An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Manag…

  41. 8.9CVE-2026-49483EPSS 0.1%

    Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reli…

  42. 7.1CVE-2026-85971EPSS 0.1%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected defau…

  43. 8.5CVE-2026-109358EPSS 0.1%

    Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd confi…

  44. 6.8CVE-2026-109244EPSS 0.10%

    FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or…

  45. 4.1CVE-2026-109243EPSS 0.1%

    FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enum…

  46. 6.8CVE-2026-108582EPSS 0.1%

    GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp…

  47. 8.4CVE-2026-107814EPSS 0.5%

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as it…

  48. 7.1CVE-2026-78339EPSS 0.09%

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vul…

  49. 7.8CVE-2026-107612EPSS 0.1%

    Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server p…

  50. 7.0CVE-2026-87660EPSS 0.1%

    An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged …