Incorrect Permission Assignment for Critical Resource
CWE-732
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
We track 420 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 5 have been exploited in real attacks.
How this weakness is prevented
- Implementation: When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user), and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
- Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources.
- Implementation Installation: During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
- System Configuration: For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
- Documentation: Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
Latest Incorrect Permission Assignment for Critical Resource vulnerabilities
- 7.1 High severity
Trusted Device Client,: Incorrect Permission Assignment for Critical Resource
Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
- 7.7 High severity
tauri-plugin-dialog: Incorrect Permission Assignment for Critical Resource
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-loo
- 8.8 High severity
Foxit PDF Editor: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitr
- 8.8 High severity
Foxit PDF Editor: Incorrect Permission Assignment for Critical Resource
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with
- 9.1 Critical severity
Apache Lounge Windows: Incorrect Permission Assignment for Critical Resource
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
- 8.4 High severity
Apache Lounge Windows: Incorrect Permission Assignment for Critical Resource
The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
- 8.4 High severity
Command | Monitor (DCM): Incorrect Permission Assignment for Critical Resource
Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege
- 8.8 High severity
DiskStation Manager (DSM): Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and co
- 7.6 High severity
omni: Exposure of Sensitive Information to an Unauthorized Actor
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in i
- 10.0 Critical severity
vm2: Incorrect Permission Assignment for Critical Resource
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use
- 7.0 High severity
Duplicati: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json fil
- 8.4 High severity
python-garminconnect: Incorrect Permission Assignment for Critical Resource
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a pe
- 7.3 High severity
froxlor: Incorrect Permission Assignment for Critical Resource
Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the par
- 10.0 Critical severity
mistral-vibe: Incorrect Permission Assignment for Critical Resource
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace w
- 9.9 Critical severity
Velociraptor: Incorrect Permission Assignment for Critical Resource
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was
- 7.1 High severity
Pardus LightDM Greeter: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Gre
- 7.8 High severity
PerformanceTest: Incorrect Permission Assignment for Critical Resource
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform priv
- 7.8 High severity
Elastic Agent: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent serv
- 7.0 High severity
ransomlook: Incorrect Default Permissions
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequentl
- 7.3 High severity
Remote Utilities Host: Incorrect Permission Assignment for Critical Resource
Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to the built-in Everyone group (BUILTIN\Everyone, S-1-1-0). A Windows service running
- 7.8 High severity
DNR1007XR: Incorrect Permission Assignment for Critical Resource
Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the abilit
- 8.1 High severity
Splunk AI Toolkit: Incorrect Permission Assignment for Critical Resource
In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access to all releva
- 8.1 High severity
Splunk Enterprise Security: Incorrect Permission Assignment for Critical Resource
In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role could change User and Entity Behavior Analytics (UEBA) search macros that scheduled searches run with administrator permissions, allowing for a
- 8.5 High severity
Planet9 background service: Incorrect Permission Assignment for Critical Resource
A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive perm
- 8.6 High severity
backup: Improper Privilege Management
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the asterisk system user witho
- 7.8 High severity
Installer: Incorrect Permission Assignment for Critical Resource
A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity,
- 7.2 High severity
AXIS OS: Incorrect Permission Assignment for Critical Resource
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.
- 9.3 Critical severity
activepieces: Exposure of Sensitive Information to an Unauthorized Actor
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worke
- 7.8 High severity
Duplicati: Incorrect Permission Assignment for Critical Resource
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory th
- 9.4 Critical severity
Oracle Agile Engineering Data Management: Improper Access Control
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to
- 9.1 Critical severity
Oracle Commerce Guided Search Platform Services: Improper Access Control
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP
- 7.1 High severity
Oracle Solaris: Improper Access Control
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris execut
- 7.3 High severity
FileGator: Incorrect Permission Assignment for Critical Resource
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission
- 7.2 High severity
A vulnerability in the web-based management interface of an ECOS device could allow a highly…
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive
- 8.8 High severity
cilium: Incorrect Permission Assignment for Critical Resource
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local atta
- 9.1 Critical severity
decompress: Improper Limitation of a Pathname to a Restricted Directory
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that dire
- 8.3 High severity
OpenClaw: Incorrect Permission Assignment for Critical Resource
OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execu
- 8.8 High severity
OpenClaw: Incorrect Permission Assignment for Critical Resource
OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input pat
- 8.8 High severity
mockoon: Missing Authentication for Critical Functionality
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Cont
- 8.8 High severity
Pardus-Parental-Control: Improper Access Control
Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before