Incorrect Permission Assignment for Critical Resource
CWE-732
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
We track 420 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 5 have been exploited in real attacks.
How this weakness is prevented
- Implementation: When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user), and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
- Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources.
- Implementation Installation: During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
- System Configuration: For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
- Documentation: Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
Latest Incorrect Permission Assignment for Critical Resource vulnerabilities
- 8.4 High severity
Plesk: Incorrect Permission Assignment for Critical Resource
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.
- 7.8 High severity
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Exploited
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
- 7.8 High severity
Core Ven: Incorrect Permission Assignment for Critical Resource
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within
- 7.8 High severity
Liman Render Engine: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81.
- 8.8 High severity
openhuman: Cleartext Storage of Sensitive Information in an Environment Variable
OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process envi
- 7.5 High severity
VitaFit: Incorrect Permission Assignment for Critical Resource
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 1
- 7.8 High severity
Foglight for Databases: Incorrect Permission Assignment for Critical Resource
Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the
- 7.8 High severity
System Manager: Improper Privilege Management
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execl
- 9.8 Critical severity
GnuPG: Creation of Temporary File in Directory with Insecure Permissions
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An atta
- 7.8 High severity
Full Client: Incorrect Permission Assignment for Critical Resource
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cau
- 7.2 High severity
Fireware OS: Improper Link Resolution Before File Access
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrit
- 7.1 High severity
macOS: Incorrect Permission Assignment for Critical Resource
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to create files in protected directories.
- 7.1 High severity
macOS: Incorrect Permission Assignment for Critical Resource
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to read or write to protected files.
- 7.8 High severity
Zimbra Collaboration Suite: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wr
- 7.8 High severity
Zimbra Collaboration Suite: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration command
- 9.3 Critical severity
CGM CLININET: Incorrect Permission Assignment for Critical Resource
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with
- 7.3 High severity
WatchGuard Agent: Incorrect Default Permissions
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows a
- 7.8 High severity
NoMachine: Incorrect Permission Assignment for Critical Resource
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-pri
- 7.8 High severity
Cisco TelePresence Video Communication Server…: Incorrect Permission Assignment for Critical Resource
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address mult
- 7.0 High severity
Application Store: Incorrect Permission Assignment for Critical Resource
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive in
- 8.4 High severity
Download Station: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have a
- 8.5 High severity
Notes Station 3: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixe
- 8.8 High severity
MOVEit Transfer: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- 8.5 High severity
AssetView: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Clie
- 8.9 High severity
vscode-ibmi: Insufficient Verification of Data Authenticity
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying compon
- 7.1 High severity
MarkLogic Server: Incorrect Permission Assignment for Critical Resource
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply
- 7.8 High severity
contrast: Incorrect Permission Assignment for Critical Resource
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwr
- 8.4 High severity
server: Incorrect Permission Assignment for Critical Resource
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A d
- 7.1 High severity
Secure Connect Gateway (SCG) Policy Manager: Incorrect Permission Assignment for Critical Resource
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t
- 7.8 High severity
TightVNC: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named sha
- 7.1 High severity
Fabric OS: Incorrect Permission Assignment for Critical Resource
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force
- 8.1 High severity
Gitea: Incorrect Permission Assignment for Critical Resource
The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and wi
- 8.2 High severity
System Update: Incorrect Permission Assignment for Critical Resource
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- 8.4 High severity
quasar: Incorrect Permission Assignment for Critical Resource
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM w
- 7.1 High severity
adm-zip: Incorrect Permission Assignment for Critical Resource
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed
- 8.5 High severity
nx: Improper Privilege Management
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. A
- 7.5 High severity
Dashcam Android Application: Incorrect Permission Assignment for Critical Resource
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live das
- 7.8 High severity
i: Incorrect Permission Assignment for Critical Resource
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.
- 7.8 High severity
Secure Connect Gateway (SCG) Policy Manager: Incorrect Permission Assignment for Critical Resource
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t
- 9.1 Critical severity
InvoicePlane: Improper Control of Filename for Include/Require Statement in PHP Program
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlle