VYPR

CWE-732

Incorrect Permission Assignment for Critical Resource

ClassDraftLikelihood: High

Description

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.

Hierarchy (View 1000)

Related attack patterns (CAPEC)

CAPEC-1 · CAPEC-122 · CAPEC-127 · CAPEC-17 · CAPEC-180 · CAPEC-206 · CAPEC-234 · CAPEC-60 · CAPEC-61 · CAPEC-62 · CAPEC-642

CVEs mapped to this weakness (1,752)

page 71 of 88
  • CVE-2025-30683MedApr 15, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2025-21585MedApr 15, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2025-21584MedApr 15, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols…

  • CVE-2025-21583MedApr 15, 2025
    NetApp
    Snapcenter
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.0 and 9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.…

  • CVE-2025-21581MedApr 15, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2025-21580MedApr 15, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols…

  • CVE-2025-21579MedApr 15, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2025-21523MedJan 21, 2025
    Oracle Corporation
    Mysql Server
    risk 0.32cvss 4.9epss 0.01

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2024-41820MedAug 5, 2024
    Kubean Io
    Kubean
    risk 0.32cvss 6.0epss 0.00

    Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do…

  • CVE-2023-22326MedFeb 1, 2023
    F5, Inc.
    Big IP
    risk 0.32cvss 4.9epss 0.01

    In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell…

  • CVE-2022-26340MedMay 5, 2022
    F5, Inc.
    BIG-IQ Centralized Management
    risk 0.32cvss 4.9epss 0.00

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated,…

  • CVE-2020-1694MedSep 16, 2020
    Keycloak
    Keycloak
    risk 0.32cvss 4.9epss 0.02

    A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

  • CVE-2018-14886MedJun 28, 2019
    Odcms
    Odoo
    risk 0.32cvss 4.9epss 0.01

    The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.

  • CVE-2018-20420MedDec 24, 2018
    Weberp
    Weberp
    risk 0.32cvss 4.9epss 0.01

    In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.

  • CVE-2018-13025MedJun 29, 2018
    Yxcms
    Yxcms
    risk 0.32cvss 4.9epss 0.01

    protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter.

  • CVE-2026-58432MedAug 13, 2026
    Go Gitea
    Gitea
    risk 0.31cvss 5.9epss 0.00

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

  • CVE-2026-29125MedMar 5, 2026
    IDC
    SFX2100 Satalite Recievers
    risk 0.31cvss 4.7epss 0.00

    IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect network communications, facilitate man-in-the-middle attacks, and cause denial of service.

  • CVE-2024-32014MedNov 11, 2025
    Siemens Foundation
    Spectrum Power 4
    risk 0.31cvss 4.7epss 0.00

    A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to alter the local database which contains the application credentials. This allows an attacker to gain administrative application privileges.

  • CVE-2024-54910MedJan 10, 2025
    Hasleo
    Backup Suite
    risk 0.31cvss 4.7epss 0.00

    Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.

  • CVE-2023-47801MedNov 13, 2023
    Click Studios
    Passwordstate
    risk 0.31cvss 4.7epss 0.00

    An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the…