CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
579 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-14988 — Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA
- CVE-2025-12004 — The compare API module breaks Extension:Lockdown
- CVE-2025-46093 — LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execut
- CVE-2025-0066 — Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
- CVE-2025-30063 — Excessive permissions on configuration files containing database logins and passwords
- CVE-2024-33499 — A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC
- CVE-2025-40804 — A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected applica
- CVE-2025-34206 — Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions
- CVE-2025-26469 — An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDrea
- CVE-2024-41171 — A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUM
- CVE-2026-29188 — File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2026-25770 — Wazuh has Privilege Escalation to Root via Cluster Protocol File Write
- CVE-2025-10643 — Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability
- CVE-2024-38337 — IBM Sterling Secure Proxy improper input validation
- CVE-2026-21765 — HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
- CVE-2025-13941 — Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2024-28827 — Privilege escalation in Windows agent
- CVE-2025-62575 — Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource
- CVE-2025-0064 — Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)
- CVE-2025-64298 — Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource
Recently published
- CVE-2026-79617 — Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
- CVE-2026-80054 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-82312 — OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial
- CVE-2026-80112 — PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys
- CVE-2021-43613 — SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
- CVE-2026-78604 — Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
- CVE-2026-84806 — Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
- CVE-2026-82697 — sambitraj Student-Management-System session_start cookie httponly flag
- CVE-2026-79783 — rclone before 1.74.4 Privilege Escalation via setuid Metadata
- CVE-2026-78553 — Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
- CVE-2026-14208 — Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0
- CVE-2026-66785 — Submariner: ipsec psk secrets file created with default world-readable permissions
- CVE-2026-18270 — Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2026-76399 — Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit
- CVE-2026-76388 — Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security
- CVE-2026-76372 — Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR
- CVE-2026-76371 — Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR
- CVE-2026-76261 — Insecure Default Access Control List through the REST API in Splunk Secure Gateway
- CVE-2026-76260 — Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise
- CVE-2026-50602 — Planet9 Incorrect Permission Assignment Vulnerability Information
More specific weaknesses
- CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag
- CWE-276 — Incorrect Default Permissions
- CWE-277 — Insecure Inherited Permissions
- CWE-278 — Insecure Preserved Inherited Permissions
- CWE-279 — Incorrect Execution-Assigned Permissions
- CWE-281 — Improper Preservation of Permissions
- CWE-766 — Critical Data Element Declared Public