Incorrect permissions are an access-control mistake where file, directory, or service rights are set too broadly or too narrowly. In practice, this means the operating system or application grants more access than intended, or blocks access that a service needs to function. In a shared environment, that can break tenant isolation and let one account or process see another account’s data.
This matters because permission errors are often quiet but high impact. Attackers look for world-readable files, misowned directories, weak ACLs, or services running with excessive privileges so they can read sensitive data, modify configuration, or escalate laterally. Defenders reduce the risk by enforcing least privilege, checking ownership and mode bits after upgrades, reviewing service accounts, and validating that backend components keep customer data separated. In systems such as calendar and contact services, a small permissions mistake can expose private schedules, address books, and business relationships without any code execution.