CWE-732: Incorrect Permissions vulnerabilities

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

CVE-2026-77256 is a vulnerability in sooperset's MCP Atlassian server affecting versions prior to 0.22.0. The issue involves incorrect permission assignment for a plaintext OAuth fallback file containing refresh and access tokens. Due to permissions inherited from the process umask, other local users may read this file under common or permissive configurations, potentially allowing unauthorized access to Atlassian products. The vulnerability is fixed in version 0.22.0.

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-<client_id>.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Dell Command | Monitor (DCM) versions prior to 10.13.2 contain a vulnerability due to incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability is identified as CWE-732 and has a high severity rating with a CVSS score of 8.4.

CVE-2026-85887 is a high-severity vulnerability in Microsoft 365 Copilot involving incorrect permission assignment for a critical resource. This flaw allows an authorized attacker to disclose sensitive information over a network. The vulnerability has been officially fixed by Microsoft. Since Microsoft 365 Copilot is a cloud service, the vendor manages remediation server-side. There are no known exploits in the wild at this time.

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. This issue is fixed in versions 1.6.6 and 1.7.3.

Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

Nextflow versions from 25.09.2-edge up to but not including 25.10.6, and from 25.11.0-edge up to but not including 26.04.3, improperly set default file permissions when writing Seqera Platform OIDC bearer tokens to seqera-auth.config. This allows local users on multi-user POSIX systems who can traverse the victim's home directory to read the token file and impersonate the victim within the token's scope. Single-user systems and headless CI runners not using interactive login are not affected. The issue is fixed in versions 25.10.6 and 26.04.3.

CVE-2026-54447 is a vulnerability in the python-garminconnect library prior to version 0.3.5 where the OAuth token directory and token file are created with overly permissive filesystem permissions. This allows other unprivileged users on the same Linux or macOS system to read the OAuth token file and gain persistent access to the victim's Garmin Connect account data. The issue is fixed in version 0.3.5.

CVE-2024-58383 is a vulnerability in Froxlor versions up to and including 2.2.0-rc3 where the file /etc/pure-ftpd/db/mysql.conf is created with insecure permissions (0644). This file contains the Froxlor SQL user's password, allowing any unprivileged local user with code execution capabilities to read it. Exploiting this, an attacker can access the database, modify administrator credentials, and escalate privileges to root. Only Froxlor instances configured to use pure-ftpd are affected.

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

CVE-2026-19583 is a critical vulnerability in Rapid7 Velociraptor versions before 0.77.2 involving incorrect permission assignment for sensitive artifacts. Specifically, client monitoring artifacts lacked proper permission checks, allowing users with scheduling rights for these artifacts to also schedule highly privileged artifacts like Linux.Sys.BashShell, which enables arbitrary command execution on endpoints. This flaw could lead to unauthorized privilege escalation and control over affected systems.

Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Greeter: before 0.4.15.

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain a vulnerability involving incorrect permission assignment for critical resources. This flaw allows a low privileged attacker with local access to potentially gain unauthorized access. The vulnerability has a medium severity with a CVSS score of 5.5. No official patch or remediation details are provided in the available data.

Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code of their choosing, ultimately obtaining SYSTEM-level privileges on the host.

CVE-2026-59292 is a low severity vulnerability in Spring Integration where the default file-based ConcurrentMetadataStore persists its state to a file with world-readable permissions. This incorrect permission assignment could expose sensitive metadata to unauthorized local users. The issue affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. No official patch or remediation guidance has been provided yet.

Remote Utilities Host versions up to 7.7.3.0 improperly assign full control permissions to the Everyone group on DLL files in the installation directory. This insecure permission setting allows a local unprivileged attacker to replace DLLs during a service stop window, leading to potential execution of malicious code with SYSTEM privileges upon service restart. The vulnerability affects multiple DLLs including libasset32.dll and others. The CVSS 4.0 score is 7.3, indicating high severity.

CVE-2026-66785 is a vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.16 involving Submariner, a Kubernetes operator for cross-cluster connectivity. A malicious spoke cluster can publish crafted network endpoints with arbitrary network subnets, causing network traffic from peer clusters to be redirected through the attacker's tunnel. This improper validation of network subnets can lead to unauthorized information disclosure or network disruption. Red Hat has released fixes in version 2.17 and Submariner v0.24 to address this issue.

CVE-2026-18270 is a local privilege escalation vulnerability in the Kenwood DNR1007XR device affecting version 1.7.0003.1000. The flaw exists in the udhcpd service due to incorrect permission assignments on a critical resource. An attacker with the ability to execute low-privileged code can exploit this to gain root privileges. The vulnerability has a high severity score of 7.8 CVSS 3.0.