CWE-732: Incorrect Permissions vulnerabilities

A vulnerability in the tox-dev filelock Python library versions 3.30.0 through 4.2.0 allows incorrect permission assignment for critical resource directories on POSIX systems. This flaw permits other local users to delete active lock claims or plant malformed claims, potentially disrupting lock acquisition. The issue is fixed in version 4.2.1.

CVE-2026-112910 is a vulnerability in the tox-dev filelock Python package affecting versions from 3.10.0 up to but not including 4.2.1 on Windows. The issue arises because the mode argument is ignored when creating WindowsFileLock files and the ReadWriteLock SQLite database, causing these locks to inherit the parent directory's inheritable ACL instead of having owner-only permissions. This allows other local accounts with inherited access to read or modify lock-related files or interfere with lock acquisition. UnixFileLock is not affected, and mutual exclusion remains functional. The vulnerability is fixed in version 4.2.1.

CVE-2026-54146 is a vulnerability in the open-source tinyhumansai openhuman agent on macOS versions from 0.53.15 up to but not including 0.57.5. The issue involves the cleartext storage of the OPENHUMAN_CORE_TOKEN bearer credential in the process environment, which can be accessed by other processes running as the same user via macOS's KERN_PROCARGS2 interface. This allows unauthorized processes to authenticate to the core JSON-RPC service with desktop frontend privileges, enabling reading of agent memory, accessing integrated-account data, invoking privileged actions, and disrupting services without elevated system permissions. The vulnerability affects both Intel and Apple Silicon macOS systems and is fixed in version 0.57.5.

Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118.

Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to potentially bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5. A fix is available in version 4.8.0 and later.

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory.

GnuPG version 2.5.21 for Windows has a critical vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create arbitrary subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

boneIO black_debian_images versions from 1.2.0 up to but not including 1.6.0 improperly assign world-readable permissions to the Mosquitto MQTT broker password file located at /etc/mosquitto/passwd. This allows any local user to read password hashes and attempt offline dictionary attacks. The issue is fixed in version 1.6.0.

CVE-2026-93640 is a local privilege escalation vulnerability in the dnscache package of Zimbra Collaboration Suite versions up to 10.1.21. It allows the Unix zimbra account to execute commands with root privileges due to an insecure passwordless sudo policy and improper argument handling in the zmunbound wrapper. This flaw enables attackers to supply malicious configurations that disable security features and expose sensitive root-owned files, potentially disclosing password hashes and private keys. The vulnerability can also corrupt privileged configuration files, causing service disruptions.

CVE-2026-50057 is a local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package. It allows the Unix zimbra account to execute arbitrary commands as root due to insecure sudo permissions for Postfix administration commands. The vulnerability arises because the sudo policy permits passwordless root execution without argument restrictions, and the Postfix configuration directory is writable by the zimbra user. Exploitation requires local access as the zimbra user on an MTA node. Versions up to and including 10.1.21 are affected.