CWE-732— Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.— MITRE CWE catalog
2,076 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-732page 32 of 42
- CVE-2025-48382MEDIUMCVSS 5.5EG 5.52025-05-27
Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to po…
- CVE-2025-32915MEDIUMCVSS 5.5EG 5.52025-05-22
Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42 and <= 2.1.0p49 (EOL). This allows a local attacker to read sensitive data.
- CVE-2025-31262MEDIUMCVSS 5.5EG 5.52025-05-19
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to modify protected parts of the file system.
- CVE-2025-40572MEDIUMCVSS 5.5EG 5.52025-05-13
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to access…
- CVE-2025-23245MEDIUMCVSS 5.5EG 5.52025-05-01
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows a guest to access global resources. A successful exploit of this vulnerability might lead to denial of service.
- CVE-2025-25041MEDIUMCVSS 5.5EG 5.52025-04-01
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM (root). A successful exploit could allow the creation of a Denial-of-Service (…
- CVE-2024-29869MEDIUMCVSS 5.5EG 5.52025-01-28
Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive infor…
- CVE-2023-38037MEDIUMCVSS 5.5EG 5.52025-01-09
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's possible for other users on the same syst…
- CVE-2024-49385MEDIUMCVSS 5.5EG 5.52025-01-02
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acronis True Image OEM (Windows) before build 42575.
- CVE-2023-49582MEDIUMCVSS 5.5EG 5.52024-08-26
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platf…
- CVE-2024-25956MEDIUMCVSS 5.5EG 5.52024-03-26
Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the information disclosure of certain system in…
- CVE-2023-42924MEDIUMCVSS 5.5EG 5.52023-12-12
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3. An app may be able to access sensitive user data.
- CVE-2023-5136MEDIUMCVSS 5.5EG 5.52023-11-08
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
- CVE-2023-44201MEDIUMCVSS 5.5EG 5.52023-10-13
An Incorrect Permission Assignment for Critical Resource vulnerability in a specific file of Juniper Networks Junos OS and Junos OS Evolved allows a local authenticated attacker to read configuration changes without having the permissions…
- CVE-2023-35799MEDIUMCVSS 5.5EG 5.52023-06-27
Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.
- CVE-2023-21142MEDIUMCVSS 5.5EG 5.52023-06-15
In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exp…
- CVE-2023-28123MEDIUMCVSS 5.5EG 5.52023-04-19
A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0.62.3 and later.
- CVE-2022-43309MEDIUMCVSS 5.5EG 5.52023-04-07
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.
- CVE-2022-3146MEDIUMCVSS 5.5EG 5.52023-03-23
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and …
- CVE-2022-3101MEDIUMCVSS 5.5EG 5.52023-03-23
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and …
- CVE-2023-20923MEDIUMCVSS 5.5EG 5.52023-01-26
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. …
- CVE-2022-47927MEDIUMCVSS 5.5EG 5.52023-01-12
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 06…
- CVE-2022-4365MEDIUMCVSS 5.5EG 5.52023-01-12
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry …
- CVE-2022-44746MEDIUMCVSS 5.5EG 5.52022-11-07
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- CVE-2022-42788MEDIUMCVSS 5.5EG 5.52022-11-01
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may be able to read sensitive location information.
- CVE-2022-32929MEDIUMCVSS 5.5EG 5.52022-11-01
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 15.7 and iPadOS 15.7, iOS 16.1 and iPadOS 16. An app may be able to access iOS backups.
- CVE-2022-26238MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to acces…
- CVE-2022-26236MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers…
- CVE-2022-26239MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to overwrite and manipulate executables and libraries. This allows attackers to access …
- CVE-2022-26237MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access…
- CVE-2022-20399MEDIUMCVSS 5.5EG 5.52022-09-13
In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. …
- CVE-2022-20290MEDIUMCVSS 5.5EG 5.52022-08-12
In Midi, there is a possible way to learn about private midi devices due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…
- CVE-2022-20284MEDIUMCVSS 5.5EG 5.52022-08-12
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of phone accounts with User execution privileges needed. User interaction is not needed for exploit…
- CVE-2014-0068MEDIUMCVSS 5.5EG 5.52022-06-30
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.
- CVE-2022-21749MEDIUMCVSS 5.5EG 5.52022-06-06
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Pa…
- CVE-2022-21748MEDIUMCVSS 5.5EG 5.52022-06-06
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS0…
- CVE-2021-0931MEDIUMCVSS 5.5EG 5.52021-12-15
In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is …
- CVE-2021-31377MEDIUMCVSS 5.5EG 5.52021-10-19
An Incorrect Permission Assignment for Critical Resource vulnerability of a certain file in the filesystem of Junos OS allows a local authenticated attacker to cause routing process daemon (RPD) to crash and restart, causing a Denial of Se…
- CVE-2021-30964MEDIUMCVSS 5.5EG 5.52021-08-24
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A malicious application may be able to bypass Privacy preferences.
- CVE-2021-30920MEDIUMCVSS 5.5EG 5.52021-08-24
A permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive information.
- CVE-2021-30892MEDIUMCVSS 5.5EG 5.52021-08-24
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to modify protected parts…
- CVE-2021-38590MEDIUMCVSS 5.5EG 5.52021-08-11
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
- CVE-2021-0552MEDIUMCVSS 5.5EG 5.52021-06-22
In getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed …
- CVE-2021-0572MEDIUMCVSS 5.5EG 5.52021-06-22
In doNotification of AccountManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed fo…
- CVE-2020-14335MEDIUMCVSS 5.5EG 5.52021-06-02
A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from thi…
- CVE-2021-23021MEDIUMCVSS 5.5EG 5.52021-06-01
The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.
- CVE-2021-28646MEDIUMCVSS 5.5EG 5.52021-04-13
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
- CVE-2019-18243MEDIUMCVSS 5.5EG 5.52021-02-18
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation.
- CVE-2019-18255MEDIUMCVSS 5.5EG 5.52021-02-18
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.
- CVE-2020-26196MEDIUMCVSS 5.5EG 5.52021-02-09
Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploit this vulnerability resulting in the ability to write data outside of the inten…
Map vulnerabilities like CWE-732 to your infrastructure
EchelonGraph correlates every CVE — across CWE-732 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →