CWE-732: Incorrect Permissions vulnerabilities

CVE-2026-50602 is a high-severity vulnerability in the Acer Planet9 background service caused by incorrect file permissions on an executable. The service runs with SYSTEM privileges, but the executable is writable by non-administrative users. This misconfiguration allows an authenticated local user to modify or replace the executable, potentially leading to arbitrary code execution with SYSTEM privileges upon service start or system reboot.

FreePBX backup versions prior to 17.0.11 contain a vulnerability in the publicKeySave AJAX endpoint that allows an authenticated administrator to append an SSH public key to the asterisk user's authorized_keys file without proper command restrictions. This grants persistent shell access with the ability to execute arbitrary commands, access sensitive data, modify system files, and disrupt services. The issue is fixed in version 17.0.11.

CVE-2026-58432 is a medium severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves missing authorization and authorization bypass through user-controlled keys and incorrect permission assignments, leading to exposure of sensitive information to unauthorized actors.

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at `src/platform/windows/misc.cpp` lives at `C:\ProgramData\LuminalShine\config\apps.json` and is created by the `SYSTEM` service. Under Windows' default `C:\ProgramData` inheritance, that gives `BUILTIN\Users` only Read+Execute — not writable — so the canonical EoP doesn't actually trigger on a vanilla install. Version 26.05.0-rc4 contains a patch for the issue. As a workaround, use default condition DACLs for `ProgramData`.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

CVE-2026-48790 is a vulnerability in turso-cli versions prior to 1.0.26 where the user's Turso platform JWT is stored with incorrect default file permissions (0o644) in settings.json. This makes the credential file world-readable on Linux and macOS systems, allowing any local user to read the file and obtain the JWT, which grants full access to the user's Turso platform organizations. The issue is fixed in version 1.0.26.

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.

A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.

CVE-2026-15430 is an improper access control vulnerability in Wellbia XIGNCODE3 version 2026.6.1.192. It affects the IRP_MJ_WRITE command interface in the xhunter2.sys driver, allowing a local, unprivileged attacker to escalate privileges to NT AUTHORITY\SYSTEM. The attacker can also extract credentials from PPL-protected lsass.exe and terminate PPL-protected security processes.

Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the udhcpd service. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of root. Was ZDI-CAN-29111.

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

Gitea Actions contains a vulnerability in the fork pull request workflow approval gate that allows an attacker with a single unprivileged account and one-time maintainer approval on a benign fork PR to permanently bypass approval for all future fork PR workflow runs from that user on the same repository. This bypass occurs because the approval check only verifies if the user has any previously approved run in the repository, without considering the pull request, commit, or workflow contents. The vulnerability affects all Gitea versions from v1.20.0 onward and remains unpatched as of this disclosure.

Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file with insecure permissions and open flags. The file is created with mode 0666 (resulting in 0644 after umask), making it world-readable. The open call lacks O_EXCL and O_NOFOLLOW flags, allowing a local attacker to exploit symlink following and pre-creation race conditions in shared directories like /tmp or /dev/shm. This can lead to unauthorized local read access to IPC payloads.

Data::SpatialHash::Shared versions before 0.02 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication payloads and potentially manipulate the file open operation by pre-creating files or symlinks at the target path.

Data::Intern::Shared versions before 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without secure flags, allowing local users to read sensitive IPC data or exploit race conditions via symlink attacks. The file is created with mode 0666 but typically results in 0644 permissions due to umask, and lacks O_EXCL and O_NOFOLLOW flags, enabling pre-creation races and symlink following in shared directories like /tmp or /dev/shm.

Data::RingBuffer::Shared versions before 0.04 for Perl create a memory-mapped backing file with world-readable permissions and open it without using secure flags O_EXCL or O_NOFOLLOW. This allows local users to read inter-process communication payloads stored in the shared segment and enables local attackers to exploit race conditions or symlink attacks to redirect file access. The vulnerability arises from incorrect permission assignment and insecure file opening practices in a shared directory.

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in roaring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.