CWE-732: Incorrect Permissions vulnerabilities

CGM CLININET contains a local privilege escalation vulnerability due to incorrect permission assignments on scripts and configuration files used by a root-privileged service processing HL7 messages. An attacker with uhcapache user privileges can modify these files to execute arbitrary code as root. Versions up to 2026.MS3 are confirmed vulnerable. A patch is available, and the product is a cloud service with vendor-managed remediation.

CVE-2025-30051 is a vulnerability in the CGM CLININET application where critical credentials for the production database and RabbitMQ broker are stored in the SysIO.pl configuration file with insecure file permissions. This misconfiguration allows any local user to read sensitive credentials. The issue was fixed in version 2026.MS3.

CVE-2026-115253 is a vulnerability in WatchGuard Agent where incorrect default permissions on the agent's log directory allow local, authenticated non-administrative users to manipulate log files and place executable content. This can lead to tampering with security logs and enable further local attacks. The issue affects versions prior to 1.25.14.0000 and has been fixed in version 1.25.14.0000.

CVE-2026-96293 is a vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS. It allows a local, unprivileged user or process to access the FileVault Personal Recovery Key by reading a diagnostic log file that is stored in cleartext and readable by all local users. This vulnerability affects WatchGuard Agent versions prior to 1.17.23.0000. The issue has been fixed in version 1.17.23.0000.

CVE-2026-111184 is a local privilege escalation vulnerability in NoMachine version 9.7.3. It arises from incorrect permission assignment on a named pipe used by the NoMachine Device Service. An attacker with the ability to execute low-privileged code locally can exploit this flaw to escalate privileges to SYSTEM level and execute arbitrary code.

CVE-2026-113720 is a vulnerability in pypa virtualenv prior to version 21.14.9 where cached package files copied with shutil.copy() retain source file permissions. This can cause files to be writable by other local users if the cache was created under a permissive umask, potentially allowing modification and execution of package code by the environment owner. The issue is fixed in version 21.14.9.

Dell Application Store versions prior to 26.05.0.7 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to potentially disclose sensitive information. The vulnerability is identified as CWE-732 and has a high severity rating with a CVSS score of 7. A fix is available in version 26.05.0.7.

CVE-2026-96542 is a vulnerability in the standalone installer for EA Javelin Anticheat on Windows that allows local non-administrative users to elevate privileges to NT AUTHORITY\SYSTEM by modifying the service configuration and executable path. This issue affects specific versions of the standalone installer and requires manual execution outside of standard game installations. The vulnerability is fixed in version 1.0.14940699 and later, with integrated EA game titles automatically repairing service permissions.

CVE-2026-96425 is a medium severity vulnerability in UBports lomiri-download-manager where incorrect DBus policy allows an arbitrary user to execute commands as root. This issue arises from improper permission assignment for a critical resource, enabling privilege escalation via DBus. The vulnerability affects versions from 0.1.0 up to but not including 0.3.3.

CVE-2026-96424 is a high-severity vulnerability in UBports' lomiri-download-manager, specifically in the lomiri-upload-manager component. It involves incorrect DBus policy permissions that allow an arbitrary user to read any file as root via DBus. This affects versions from 0.1.0 up to but not including 0.3.3.

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

CVE-2026-34008 is a high-severity vulnerability in QNAP Systems Inc. Notes Station 3 involving incorrect permission assignment for a critical resource. A local attacker with a user account can exploit this flaw to compromise system security. The issue is fixed in Notes Station 3 version 3.9.11 and later.

CVE-2026-34014 is a high-severity vulnerability in QNAP Systems Inc.'s Download Station involving incorrect permission assignment for a critical resource. A local attacker with administrator privileges can exploit this flaw to compromise system security. The issue has been fixed in Download Station versions 5.10.1.312 and later, and 5.11.2.321 and later.

CVE-2026-104618 is a vulnerability in SUSE Linux Enterprise Server 16.1 where the sdbootutil script creates a debug log file (/var/log/sdbootutil.log) with world-readable permissions. This incorrect permission assignment allows any low-privileged user on the system to read potentially sensitive information from the log file.

CVE-2026-87093 is a high-severity vulnerability in Progress MOVEit Transfer involving incorrect permission assignment for a critical resource. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability can lead to complete confidentiality, integrity, and availability compromise of the affected system.

CVE-2026-97792 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving improper access control in the Windows Container Isolation FS Filter Driver (unionfs.sys). This flaw allows an authorized local attacker to elevate privileges due to incorrect permission assignments on critical resources. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has issued official fixes for the affected versions.

CVE-2026-97800 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 involving incorrect permission assignment for a critical resource in Windows Mobile Broadband. This flaw allows an authorized local attacker to elevate privileges. The issue affects specific builds prior to fixed versions released by Microsoft. An official fix is available and has been released in multiple Windows 11 builds.

CVE-2026-49483 is a high-severity vulnerability in the codefori vscode-ibmi Visual Studio Code extension prior to version 3.0.1. The issue involves incorrect permission assignment for IBMi components, allowing local accounts to alter programs due to broad public permissions and insufficient integrity verification. The vulnerability is fixed in version 3.0.1.

Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 have a vulnerability where certain log files are assigned overly permissive operating system permissions. This misconfiguration allows local users to read or modify log data. The issue is addressed by correcting default permissions for newly created and rotated logs, but existing logs retain their original permissions until manually remediated.