Weakness (CWE)
CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
How to prevent it (8 mitigations)
-
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Implementation, Installation
During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
-
System Configuration
For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
-
Documentation
Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
-
Installation
Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.
-
Operation, System Configuration
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Source: MITRE CWE-732
80 results · Clear filters · Feed
-
Critical 9.1
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to anot…
-
Critical 9.1
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized att…
-
Critical 9.1
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorize…
-
Critical 9.1
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading t…
-
Critical 9.8
CVE-2026-118131
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An att…
-
Critical 9.3
Local Privilege Escalation in CGM CLININET
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with…
-
Critical 9.1
InvoicePlane: Remote Code Execution via Writable Templates Directory
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controll…
-
Critical 9.1CVE-2026-89282 Public exploit
CVE-2026-89282
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
-
Critical 10.0
vm2 before 3.11.6 Process-wide State Exposure via os and dns
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver g…
-
Critical 10.0
vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use…
-
Critical 10.0
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through comm…
-
Critical 9.9
Velociraptor Required Permissions bypass by using client monitoring queries
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was…
-
Critical 9.3
Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same work…
-
Critical 9.4
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The …
-
Critical 9.1
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…
-
Critical 9.2
Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local att…
-
Critical 9.1
decompress: Archive extraction can create files and links outside the target directory
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that dir…
-
Critical 9.3
MDM Server Registration Overriding
Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.
-
Critical 10.0
Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar
Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attack…
-
Critical 9.3
electerm: Local code through electerm's single-instance socket
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
-
Critical 9.9
Apache Polaris: No protection on `write.metadata.path`
In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `write.metadata.path` is an optional table property that tells Polaris where to write those metadata files…
-
Critical 9.1
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the sec…
-
Critical 9.1
Wazuh has Privilege Escalation to Root via Cluster Protocol File Write
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The `wazu…
-
Critical 9.1
File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authen…
-
Critical 9.8
Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root
An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly d…
-
Critical 9.4
Kata Container to Guest micro VM privilege escalation
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify th…
-
Critical 10.0
Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA
A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confidentiality, integrity, or availability of the system.
-
Critical 10.0
Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating system user account within an initialization script. The SSH service is network-accessible without IP-based restrictions. Although the confi…
-
Critical 10.0
The compare API module breaks Extension:Lockdown
Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.
-
Critical 9.3
Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such…
-
Critical 9.1
Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability
Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Wondershare Repairit. Authentication is not required to exploit this vul…
-
Critical 9.1
A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected applic…
-
Critical 9.4
Excessive permissions on configuration files containing database logins and passwords
The configuration file containing database logins and passwords is readable by any local user.
-
Critical 9.6CVE-2025-4609 Public exploit
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allo…
-
Critical 9.8
Sandboxed iframe could start downloads
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
-
Critical 9.3CVE-2012-10030 Public exploit
FreeFloat FTP Server Arbitrary File Upload
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and im…
-
Critical 9.9
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execu…
-
Critical 9.8
Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitiv…
-
Critical 10.0CVE-2014-125121 Public exploit
Array Networks vAPV and vxAG Default Credential Privilege Escalation
Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devi…
-
Critical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma…