CWE-732— Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.— MITRE CWE catalog

2,076 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-732page 41 of 42

CVE-2023-25817LOWCVSS 3.5EG 3.5
2023-03-27
Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This is…
CVE-2022-20330LOWCVSS 3.5EG 3.5
2022-08-12
In Bluetooth, there is a possible way to connect or disconnect bluetooth devices without user awareness due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interac…
CVE-2022-24236LOWCVSS 3.5EG 3.5
2022-03-21
An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts.
CVE-2026-124039LOWCVSS 3.3EG 3.3
2026-11-06
Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is pa…
CVE-2026-64616LOWCVSS 3.3EG 3.3
2026-07-21
Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in ndarray.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under …
CVE-2026-64615LOWCVSS 3.3EG 3.3
2026-07-21
Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in graph.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the …
CVE-2025-59866LOWCVSS 3.3EG 3.3
2026-07-17
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable…
CVE-2026-35367LOWCVSS 3.3EG 3.3
2026-04-22
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (06…
CVE-2026-35353LOWCVSS 3.3EG 3.3
2026-04-22
The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chm…
CVE-2026-21727LOWCVSS 3.3EG 3.3
2026-04-15
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user wi…
CVE-2026-21715LOWCVSS 3.3EG 3.3
2026-03-30
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `…
CVE-2025-40818LOWCVSS 3.3EG 3.3
2025-12-09
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read th…
CVE-2025-59349LOWCVSS 3.3EG 3.3
2025-09-17
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certain directory paths with specific access permissions. This function does not perf…
CVE-2024-38864LOWCVSS 3.3EG 3.3
2024-12-19
Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p23, < 2.2.0p38 and <= 2.1.0p49 (EOL) allows a local attacker to read sensitive data.
CVE-2024-6780LOWCVSS 3.3EG 3.3
2024-07-16
Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.
CVE-2024-28745LOWCVSS 3.3EG 3.3
2024-03-18
Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulner…
CVE-2024-22236LOWCVSS 3.3EG 3.3
2024-01-31
In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permission…
CVE-2022-41926LOWCVSS 3.3EG 3.3
2022-11-25
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that t…
CVE-2022-20262LOWCVSS 3.3EG 3.3
2022-08-12
In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed fo…
CVE-2020-8908LOWCVSS 3.3EG 3.3
2020-12-10
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(…
CVE-2012-6655LOWCVSS 3.3EG 3.3
2019-11-27
An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
CVE-2019-13679LOWCVSS 3.3EG 3.3
2019-11-25
Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file.
CVE-2019-15340LOWCVSS 3.3EG 3.3
2019-11-14
The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (version…
CVE-2019-15339LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) tha…
CVE-2019-15338LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88_lite/iris88_lite:8.1.0/O11019/1536323070:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, ve…
CVE-2019-15337LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.31) that a…
CVE-2019-15336LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61_Turbo/Z61_Turbo:8.1.0/O11019/1536917928:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionNa…
CVE-2019-15335LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that a…
CVE-2019-15334LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88_go/iris88_go:8.1.0/O11019/1538188945:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionN…
CVE-2019-15333LOWCVSS 3.3EG 3.3
2019-11-14
The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) tha…
CVE-2019-5642LOWCVSS 3.3EG 3.3
2019-11-06
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of t…
CVE-2016-4983LOWCVSS 3.3EG 3.3
2019-11-05
A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
CVE-2019-11806LOWCVSS 3.3EG 3.3
2019-08-20
OX App Suite 7.10.1 and earlier has Insecure Permissions.
CVE-2018-20936LOWCVSS 3.3EG 3.3
2019-08-01
cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).
CVE-2019-14395LOWCVSS 3.3EG 3.3
2019-07-30
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
CVE-2018-12209LOWCVSS 3.3EG 3.3
2019-03-14
Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and …
CVE-2019-7729LOWCVSS 3.3EG 3.3
2019-02-22
An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip shar…
CVE-2017-1699LOWCVSS 3.3EG 3.3
2018-01-04
IBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it creates. A local attacker could exploit this vulnerability to modify or delete data contained in the files with an unknown impact. IBM X-Force ID:…
CVE-2017-1716LOWCVSS 3.3EG 3.3
2017-12-13
IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a local attacker due to improper permission settings. IBM X-Force ID: 134638.
CVE-2020-1736LOWCVSS 2.2EG 3.3
2020-03-16
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the fil…
CVE-2026-59292LOWCVSS 3.2EG 3.2
2026-08-27
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integr…
CVE-2025-68462LOWCVSS 3.2EG 3.2
2025-12-18
Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.
CVE-2025-52992LOWCVSS 3.2EG 3.2
2025-06-27
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26…
CVE-2023-26427LOWCVSS 3.2EG 3.2
2023-06-20
Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly availabl…
CVE-2023-2876LOWCVSS 3.1EG 3.1
2023-06-13
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0…
CVE-2023-29092LOWCVSS 3.1EG 3.1
2023-05-09
An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding of a wrong resource can occur due to improper handling of parameters while binding a network interf…
CVE-2017-15352LOWCVSS 3.1EG 3.1
2018-02-15
Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5600 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 580…
CVE-2026-32684LOWCVSS 2.9EG 2.9
2026-05-12
The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information.
CVE-2021-41802LOWCVSS 2.9EG 2.9
2021-10-08
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed i…
CVE-2020-8029LOWCVSS 2.9EG 2.9
2021-02-11
A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet key. This issue affects: SUSE CaaS Platform 4.5 skuba versions prior to https://gi…

Map vulnerabilities like CWE-732 to your infrastructure

EchelonGraph correlates every CVE — across CWE-732 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →