A permissions vulnerability is a flaw in access control where a system grants users more data or actions than their role should allow. The problem is usually not the protocol itself, but the authorization checks that sit around it: who owns an object, which tenant it belongs to, and whether the requester is allowed to read or change it.
These bugs matter because they can break tenant isolation and expose sensitive information without requiring full system compromise. In shared services, a local or low-privileged user may be able to access another account’s calendars, contacts, files, or messages if object-level permission checks are missing or applied inconsistently. Defenders look for this class of issue by testing unauthorized reads and writes across accounts, reviewing how identities map to resources, and verifying that fixes also clean up existing data. In attacks, the impact is often quiet but serious: confidential data leaks even when the attacker never gains admin rights.