CWE-732— Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.— MITRE CWE catalog

2,076 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-732page 39 of 42

CVE-2021-35202MEDIUMCVSS 4.3EG 4.3
2021-09-30
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.
CVE-2021-29711MEDIUMCVSS 4.3EG 4.3
2021-07-08
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 6.2.7.8 , 6.2.7.9, 7.0.3.0, 7.0.4.0, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2 could allow an authenticated user with certain permissions to initiate an agent upgrade through the CLI inter…
CVE-2021-36129MEDIUMCVSS 4.3EG 4.3
2021-07-02
An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage…
CVE-2021-31929MEDIUMCVSS 4.3EG 4.3
2021-06-10
Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupon groups, email templates, or referrals.
CVE-2021-33586MEDIUMCVSS 4.3EG 4.3
2021-05-27
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
CVE-2021-32056MEDIUMCVSS 4.3EG 4.3
2021-05-10
Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.
CVE-2021-30478MEDIUMCVSS 4.3EG 4.3
2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a …
CVE-2021-30477MEDIUMCVSS 4.3EG 4.3
2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that t…
CVE-2021-30156MEDIUMCVSS 4.3EG 4.3
2021-04-09
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists.
CVE-2021-30152MEDIUMCVSS 4.3EG 4.3
2021-04-09
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
CVE-2020-35934MEDIUMCVSS 4.3EG 4.3
2021-01-01
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object …
CVE-2019-11786MEDIUMCVSS 4.3EG 4.3
2020-12-22
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms, which may lead to arbitrary content modification on translatable elements.
CVE-2020-26177MEDIUMCVSS 4.3EG 4.3
2020-12-18
In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the gre…
CVE-2020-26171MEDIUMCVSS 4.3EG 4.3
2020-12-18
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
CVE-2020-29454MEDIUMCVSS 4.3EG 4.3
2020-12-02
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
CVE-2020-28953MEDIUMCVSS 4.3EG 4.3
2020-11-19
In BigBlueButton before 2.2.29, a user can vote more than once in a single poll.
CVE-2020-26932MEDIUMCVSS 4.3EG 4.3
2020-10-10
debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode 4750 (for access by the sympa group)
CVE-2020-15595MEDIUMCVSS 4.3EG 4.3
2020-09-30
An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire …
CVE-2020-15697MEDIUMCVSS 4.3EG 4.3
2020-07-15
An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.
CVE-2016-11080MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
CVE-2016-11065MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
CVE-2017-18910MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links.
CVE-2017-18878MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
CVE-2018-21256MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.
CVE-2018-21252MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.
CVE-2017-18872MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
CVE-2019-20887MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts.
CVE-2019-20883MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.
CVE-2019-20879MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry.
CVE-2018-21261MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.
CVE-2018-21255MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.
CVE-2018-21254MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.
CVE-2018-21253MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.
CVE-2017-18870MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
CVE-2019-4603MEDIUMCVSS 4.3EG 4.3
2020-04-08
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.
CVE-2019-19263MEDIUMCVSS 4.3EG 4.3
2020-01-03
GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.
CVE-2019-19262MEDIUMCVSS 4.3EG 4.3
2020-01-03
GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.
CVE-2019-19087MEDIUMCVSS 4.3EG 4.3
2020-01-03
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).
CVE-2019-19086MEDIUMCVSS 4.3EG 4.3
2020-01-03
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).
CVE-2019-18453MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.
CVE-2019-18450MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.
CVE-2019-18449MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2).
CVE-2019-18447MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.
CVE-2019-18446MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).
CVE-2019-18463MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4).
CVE-2019-18462MEDIUMCVSS 4.3EG 4.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions.
CVE-2019-13681MEDIUMCVSS 4.3EG 4.3
2019-11-25
Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML page.
CVE-2019-13676MEDIUMCVSS 4.3EG 4.3
2019-11-25
Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-12635MEDIUMCVSS 4.3EG 4.3
2019-09-05
A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected sof…
CVE-2018-20907MEDIUMCVSS 4.3EG 4.3
2019-08-01
cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

Map vulnerabilities like CWE-732 to your infrastructure

EchelonGraph correlates every CVE — across CWE-732 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →