CWE · MITRE source
CWE-732Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (72)AI
Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-14 | Public Access Protections | SC | Requires correct permission settings on public-facing resources to block unauthorized read/write access. |
SC-15 | Collaborative Computing Devices and Applications | SC | Forces correct permission settings on device resources so remote parties cannot activate them. |
SC-2 | Separation of System and User Functionality | SC | Ensures critical system resources and functions receive permission assignments distinct from ordinary user resources. |
PM-1 | Information Security Program Plan | PM | Treating the plan as a critical resource and requiring it to be protected from unauthorized modification or disclosure drives correct permission assignment. |
PM-10 | Authorization Process | PM | Security authorization processes review and approve permission assignments for critical resources, reducing the chance that incorrect permission assignments remain unaddressed. |
PM-12 | Insider Threat Program | PM | Program reviews and corrects overly permissive resource assignments that insiders could exploit for unauthorized access. |
CM-1 | Policy and Procedures | CM | Procedures specify correct permission assignments for critical configuration files and resources as part of baseline and change management. |
CM-12 | Information Location | CM | Documenting users and component locations facilitates correct permission assignments for critical resources. |
CM-2 | Baseline Configuration | CM | Maintaining baseline configuration controls permission assignments for critical resources and detects unauthorized changes. |
SA-14 | Criticality Analysis | SA | The control directly supports correct permission assignment by first determining which resources are critical, thereby lowering the likelihood of insecure permissions on those resources. |
SA-16 | Developer-provided Training | SA | Training on security functions includes correct permission assignment for critical resources, lowering misconfiguration risk. |
SA-17 | Developer Security and Privacy Architecture and Design | SA | Mandates accurate specification of control allocation, making incorrect default or assigned permissions on critical resources less probable at design time. |
PE-1 | Policy and Procedures | PE | Policy specifies correct permission assignments for physical critical resources and facilities. |
PE-10 | Emergency Shutoff | PE | The emergency shutoff is a critical resource whose activation is protected via proper permission assignment. |
PE-16 | Delivery and Removal | PE | Ensures correct permission assignments for critical physical resources during delivery and removal processes. |
Show 57 more broadly-applicable controls
SC-27 | Platform-independent Applications | SC | Platform-independent applications inherit runtime-enforced resource permissions instead of relying on error-prone native file or process permission assignments. |
SC-3 | Security Function Isolation | SC | Security functions become critical resources whose permissions can be assigned narrowly and independently of the rest of the system. |
SC-32 | System Partitioning | SC | Supports correct permission assignment by allowing permissions to be scoped to individual partitions rather than a monolithic system. |
SC-34 | Non-modifiable Executable Programs | SC | Overrides or renders irrelevant incorrect permission assignments on critical executable resources by using hardware-level immutability. |
SC-39 | Process Isolation | SC | By giving each process its own protected domain, the control reduces the impact of incorrect permission assignments on critical resources shared across processes. |
SC-43 | Usage Restrictions | SC | Establishing usage restrictions and guidelines directly addresses assignment of appropriate permissions to critical components. |
SC-49 | Hardware-enforced Separation and Policy Enforcement | SC | Hardware mechanisms enforce correct permission assignments on critical resources that would otherwise be modifiable by software. |
SC-50 | Software-enforced Separation and Policy Enforcement | SC | Software-enforced separation ensures correct permission assignments on critical resources between domains. |
SC-51 | Hardware-based Protection | SC | Directly implements hardware-enforced write protection on critical resources instead of relying on potentially incorrect software permissions. |
PM-13 | Security and Privacy Workforce | PM | Training addresses permission management, reducing incorrect permission assignments on critical resources. |
PM-23 | Data Governance Body | PM | Provides oversight for correct permission and privilege assignments on data stores, files, and repositories. |
PM-29 | Risk Management Program Leadership Roles | PM | Risk Executive function drives correct permission assignment for critical resources by requiring risk analysis before granting broad access. |
PM-32 | Purposing | PM | Triggers re-evaluation of permission assignments on critical resources when usage deviates from declared purpose. |
PM-4 | Plan of Action and Milestones Process | PM | Drives systematic identification, documentation, and closure of incorrect critical-resource permission assignments through tracked milestones. |
PM-7 | Enterprise Architecture | PM | Architecture standards define default and required permission models for critical resources, mitigating incorrect permission assignments. |
PM-8 | Critical Infrastructure Plan | PM | The control requires correct permission assignments on critical resources as part of the documented CIKR security and privacy protections. |
PM-9 | Risk Management Strategy | PM | Strategy requires assessment and assignment of permissions for critical resources, reducing incorrect default or inherited permissions. |
CM-3 | Configuration Change Control | CM | Controls changes to critical resources, helping maintain correct permission assignments and preventing insecure modifications. |
CM-4 | Impact Analyses | CM | Changes to permissions on critical resources are assessed to prevent incorrect assignments. |
CM-5 | Access Restrictions for Change | CM | Defining and enforcing access restrictions ensures correct permission assignments on resources that support changes. |
CM-6 | Configuration Settings | CM | Documenting and enforcing configuration settings ensures correct permission assignments for critical resources. |
CM-7 | Least Functionality | CM | Configuring systems to provide only required functionality avoids incorrect permission assignments on unneeded resources, ports, or services. |
CM-9 | Configuration Management Plan | CM | Places configuration items under formal management, enforcing correct permission assignments on critical resources. |
SA-18 | Tamper Resistance and Detection | SA | Correct and hardened permission assignments on critical resources are a primary means of achieving tamper resistance at the system level. |
SA-3 | System Development Life Cycle | SA | Documented roles, responsibilities, and continuous risk management in the SDLC ensure that default and runtime permissions for critical resources are deliberately assigned and reviewed. |
SA-5 | System Documentation | SA | Documentation covering secure installation and permission settings reduces incorrect permission assignments on critical resources. |
SA-7 | User-installed Software | SA | Requires correct permission assignments on system resources and install mechanisms to block user installs. |
SA-8 | Security and Privacy Engineering Principles | SA | Permission-assignment and least-privilege principles prevent incorrect critical-resource permissions. |
PE-17 | Alternate Work Site | PE | The requirement to employ and assess controls at alternate sites includes ensuring correct permission assignments for critical resources that could otherwise be misconfigured in remote environments. |
PE-3 | Physical Access Control | PE | Mandates securing keys/combinations, periodic inventory, and rotation on compromise or personnel changes to correct improper physical permission assignments. |
PE-7 | Visitor Control | PE | Prevents default or overly broad physical permissions by requiring per-visitor access decisions and time-limited credentials. |
PE-9 | Power Equipment and Cabling | PE | Ensures that a critical resource (power delivery) receives appropriate physical permission assignments and safeguards instead of default or inadequate protection. |
RA-1 | Policy and Procedures | RA | Risk assessment procedures include review of permission assignments on critical resources, directly lowering the chance of persistent incorrect assignments. |
RA-2 | Security Categorization | RA | Security category directly informs the required permission settings for critical resources before authorization occurs. |
RA-3 | Risk Assessment | RA | Assessment of system vulnerabilities includes permission and privilege misconfigurations that enable unauthorized resource access. |
RA-5 | Vulnerability Monitoring and Scanning | RA | Permission and ACL misconfigurations on critical resources are standard findings in automated scans. |
RA-7 | Risk Response | RA | Incorrect permission assignments on critical resources are typical audit findings; responding to them per risk tolerance removes the excessive privileges that enable exploitation. |
RA-9 | Criticality Analysis | RA | The analysis directly locates critical resources so that permission assignments can be made correctly rather than left incorrect or default. |
AC-1 | Policy and Procedures | AC | Procedures support proper permission assignment for critical resources through documented controls. |
AC-16 | Security and Privacy Attributes | AC | Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels. |
AC-6 | Least Privilege | AC | Prevents overly permissive assignments to critical resources by limiting to task needs. |
CP-10 | System Recovery and Reconstitution | CP | Reconstitution corrects improper permission assignments on critical resources. |
CP-6 | Alternate Storage Site | CP | Requiring equivalent controls prevents incorrect permission assignments on critical backup resources at the alternate site. |
CP-9 | System Backup | CP | Protecting backup availability and integrity requires correct permission assignments on critical backup resources. |
PS-5 | Personnel Transfer | PS | Drives correction of permission assignments on critical resources when individuals move to new positions with different needs. |
PS-8 | Personnel Sanctions | PS | Sanctions discourage incorrect permission assignments on critical resources when such actions violate security policy. |
PS-9 | Position Descriptions | PS | Security responsibilities documented in job descriptions guide correct initial and ongoing permission assignments for critical resources. |
AT-1 | Policy and Procedures | AT | Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources. |
AT-3 | Role-based Training | AT | Training on permission management reduces incorrect permission assignments for critical resources. |
CA-2 | Control Assessments | CA | Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions. |
CA-4 | Security Certification | CA | Certification includes checking that permissions on critical resources are correctly assigned. |
PL-11 | Baseline Tailoring | PL | Tailoring actions include assigning or restricting permissions on critical resources to the minimum necessary for the system's purpose and threat environment. |
PL-9 | Central Management | PL | Central management of critical-resource permissions ensures uniform, least-privilege assignments rather than per-system manual settings that frequently drift. |
AU-9 | Protection of Audit Information | AU | Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions. |
MP-2 | Media Access | MP | Restricting media access ensures correct permission assignments for this critical resource. |
SI-1 | Policy and Procedures | SI | Procedures require correct default and assigned permissions on critical resources, tangibly lowering the chance of overly permissive settings. |
SR-9 | Tamper Resistance and Detection | SR | Provides detection and resistance layers that reduce exploitability of incorrect critical-resource permissions. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2022-22960 KEV | 7.9 | 7.8 | 0.7266 | 2022-04-13 |
CVE-2011-3923 | 7.4 | 9.8 | 0.9105 | 2019-11-01 |
CVE-2018-15379 | 7.3 | 9.8 | 0.8946 | 2018-10-05 |
CVE-2021-44521 | 7.3 | 9.1 | 0.9101 | 2022-02-11 |
CVE-2019-15752 KEV | 6.5 | 7.8 | 0.4932 | 2019-08-28 |
CVE-2020-0668 | 6.4 | 7.8 | 0.8089 | 2020-02-11 |
CVE-2018-12296 | 5.9 | 7.5 | 0.7313 | 2019-05-13 |
CVE-2018-14916 | 5.9 | 9.1 | 0.6793 | 2019-06-28 |
CVE-2018-1000226 | 5.6 | 9.8 | 0.6001 | 2018-08-20 |
CVE-2012-10030 | 5.6 | 9.8 | 0.6098 | 2025-08-05 |
CVE-2021-37304 | 5.3 | 7.5 | 0.6353 | 2023-02-03 |
CVE-2021-37305 | 4.9 | 7.5 | 0.5683 | 2023-02-03 |
CVE-2017-9462 | 4.7 | 8.8 | 0.4870 | 2017-06-06 |
CVE-2018-10285 | 4.4 | 9.8 | 0.4114 | 2018-04-22 |
CVE-2020-11107 | 4.1 | 8.8 | 0.3891 | 2020-04-02 |
CVE-2017-20198 | 4.0 | 0.0 | 0.6676 | 2025-07-23 |
CVE-2018-4072 | 3.9 | 8.8 | 0.3626 | 2019-05-06 |
CVE-2018-4073 | 3.9 | 8.8 | 0.3626 | 2019-05-06 |
CVE-2023-50292 | 3.9 | 7.5 | 0.4012 | 2024-02-09 |
CVE-2017-6104 | 3.8 | 7.5 | 0.3860 | 2017-03-02 |
CVE-2017-5260 | 3.8 | 8.8 | 0.3339 | 2017-12-20 |
CVE-2021-23874 KEV | 3.7 | 8.2 | 0.0085 | 2021-02-10 |
CVE-2017-3006 | 3.2 | 8.8 | 0.2411 | 2017-04-12 |
CVE-2018-13374 KEV | 3.1 | 4.3 | 0.0378 | 2019-01-22 |
CVE-2017-17867 | 2.9 | 8.8 | 0.1981 | 2018-01-04 |