CWE-732
CVEs classified under CWE-732, newest first.
183 CVEsRSS
CVE-2026-118131NoneCVE-2026-118131
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories u…
CVE-2026-90464High· 7.2Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create…
CVE-2026-92377High· 7.8Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forg…
CVE-2026-77060Medium· 6.8Incorrect Permission Assignment for Critical Resource in boneIO
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.…
CVE-2026-50057High· 7.8Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix…
CVE-2026-93640High· 7.8Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments…
CVE-2025-30051Medium· 6.8Insecure File Permissions in CGM CLININET
The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This i…
CVE-2025-30054Critical· 9.3Local Privilege Escalation in CGM CLININET
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache …
CVE-2026-113720Medium· 4.4virtualenv: Seeded files retain permissions from an older cache
virtualenv: Seeded files retain permissions from an older cache
CVE-2026-96293Medium· 6.9Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery K…
CVE-2026-115253High· 7.3WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the d…
CVE-2026-111184High· 7.80dayNoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the abi…
CVE-2026-76495High· 7.8Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening rel…
CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file a…
CVE-2026-71169High· 7.0Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Dis…
CVE-2026-96542Medium· 5.0EA Javelin Anticheat Installer Local Privilege Escalation
Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges …
CVE-2026-96425Medium· 5.5Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
CVE-2026-96424High· 7.8Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus
CVE-2026-92228Medium· 6.5The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision te…
CVE-2026-102740Medium· 5.8The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses
The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predict…
CVE-2026-34014High· 8.4An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security o…
CVE-2026-34008High· 8.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the syste…
CVE-2026-104618Medium· 6.2On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log
On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secr…
CVE-2026-87093High· 8.8Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
CVE-2026-70402Medium· 5.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modif…
CVE-2026-78632Medium· 5.3The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions…
CVE-2026-97800High· 7.8Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
CVE-2026-97792High· 7.8Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-101020High· 7.8An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Man…
CVE-2026-49483High· 8.9Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without re…