{
  "node_id": "mitre-cwe-732-incorrect-permission-assignment",
  "title": "MITRE CWE-732 - Incorrect Permission Assignment for Critical Resource",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-05",
  "bluf": "CWE-732 (Incorrect Permission Assignment for Critical Resource) is a CWE Top 25 weakness consistently present in cloud misconfiguration incidents (public S3 buckets, world-readable Kubernetes secrets, public Elasticsearch instances) and operating system file permission flaws. CWE-732 is defined as: the product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. The Extended Description notes that when resources receive overly permissive settings, unintended parties can access sensitive information or make unauthorized modifications; this proves especially hazardous for configuration files, executables, or user data; a misconfigured cloud storage account readable by anonymous users exemplifies this vulnerability. Common Consequences include confidentiality impact (attackers may read sensitive data like credentials or configuration information from improperly secured resources); access control impact (adversaries could modify critical resource properties to escalate privileges, such as replacing executable files with malicious code); and integrity impact (attackers may destroy or corrupt critical data stored in inadequately protected resources, including database records). Potential Mitigations include verifying critical resources lack insecure permissions during startup and generating errors if unauthorized modification is possible; dividing software into distinct user groups with corresponding privilege levels and mapped resource permissions; executing code within sandbox environments (chroot, AppArmor, SELinux) to restrict file and command access; setting restrictive default permissions and umask values at program initialization and installation; restricting configuration files and executables to administrator read/write access only; and disabling public access for cloud storage (S3, Azure, Google Cloud Storage) using provider controls.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "industry_mapping",
      "related_frameworks"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-cwe-269-improper-privilege-management"
  ],
  "primary_citations_count": 10
}