From 23cad6fea914a13cc4261b8d3698ebffa947f62c Mon Sep 17 00:00:00 2001
From: Zachary Prebosnyak <91638307+zprebosnyak-lm@users.noreply.github.com>
Date: Thu, 25 Jul 2024 15:55:37 -0600
Subject: [PATCH] Permission deconstruction (#1)

* fix: intial push for CI jobs

* fix: adding Node Full from pipeline catalog

* fix: disabling jobs

* fix: trying pipeline tepmplate

* fix: fix syntax error

* fix: enable node_ci job

* added artifacts for node-build

* fix spacing issue

* fix: addded curl request to add jq

* fix: replace cat with cmd

* fix: add \ and &&

* test: test directives permission logic

* test: different permission for directive

* test: revert old permissions test, test case with new permissions

* fix: copy pasta'd myself

* test: progress push

* test: temp

* test: ci updates

* feat: update UI for permissions

* fix: var name

* fix: revert to original values

---------

Co-authored-by: johnny mayer <johnny.w.mayer.iii@lmco.com>
Co-authored-by: Mensah, Ephraim E <ephraim.e.mensah@lmco.com>
Co-authored-by: Cortes, Noel <noel.cortes@lmco.com>
---
 src/containers/DefaultContainer.vue           |  24 +-
 src/mixins/permissionsMixin.js                |  56 ++-
 src/router/index.js                           | 387 +++++++++++++++---
 src/shared/permissions.js                     |  38 +-
 src/views/Dashboard.vue                       |   3 +-
 src/views/administration/AdminMenu.vue        |  22 +-
 src/views/administration/Administration.vue   |   8 +-
 src/views/policy/LicenseGroupList.vue         |  13 +-
 src/views/policy/PolicyCondition.vue          |   1 +
 src/views/policy/PolicyList.vue               |  12 +-
 src/views/policy/PolicyManagement.vue         |   2 +-
 src/views/policy/VulnerabilityPolicyList.vue  |   4 +-
 src/views/portfolio/licenses/License.vue      |   2 +-
 src/views/portfolio/licenses/LicenseList.vue  |   2 +-
 .../portfolio/projects/ComponentDashboard.vue |   2 +-
 .../projects/ComponentDetailsModal.vue        |  48 +--
 src/views/portfolio/projects/FindingAudit.vue |  10 +-
 .../projects/ProjectAddComponentModal.vue     |   2 +-
 .../portfolio/projects/ProjectComponents.vue  |   9 +-
 .../portfolio/projects/ProjectDashboard.vue   |   2 +-
 .../projects/ProjectDetailsModal.vue          |  28 +-
 .../portfolio/projects/ProjectFindings.vue    |   4 +-
 src/views/portfolio/projects/ProjectList.vue  |   2 +-
 .../projects/ProjectPropertiesModal.vue       |   2 +-
 .../portfolio/projects/ServiceDashboard.vue   |   2 +-
 .../projects/ServiceDetailsModal.vue          |  12 +-
 .../VulnerabilityDetailsModal.vue             |  10 +-
 .../vulnerabilities/VulnerabilityList.vue     |   2 +-
 28 files changed, 548 insertions(+), 161 deletions(-)

diff --git a/src/containers/DefaultContainer.vue b/src/containers/DefaultContainer.vue
index acee1809..6e422704 100644
--- a/src/containers/DefaultContainer.vue
+++ b/src/containers/DefaultContainer.vue
@@ -126,19 +126,37 @@ export default {
             element: '',
             attributes: {},
           },
-          permission: permissions.SYSTEM_CONFIGURATION,
+          permission: [
+            permissions.SYSTEM_CONFIGURATION,
+            permissions.SYSTEM_CONFIGURATION_CREATE,
+            permissions.SYSTEM_CONFIGURATION_READ, 
+            permissions.SYSTEM_CONFIGURATION_UPDATE,
+            permissions.SYSTEM_CONFIGURATION_DELETE
+          ],
         },
         {
           name: this.$t('message.policy_management'),
           url: '/policy',
           icon: 'fa fa-list-alt',
-          permission: permissions.POLICY_MANAGEMENT,
+          permission: [
+            permissions.POLICY_MANAGEMENT,
+            permissions.POLICY_MANAGEMENT_CREATE,
+            permissions.POLICY_MANAGEMENT_READ,
+            permissions.POLICY_MANAGEMENT_UPDATE,
+            permissions.POLICY_MANAGEMENT_DELETE
+          ],
         },
         {
           name: this.$t('message.administration'),
           url: '/admin',
           icon: 'fa fa-cogs',
-          permission: permissions.SYSTEM_CONFIGURATION,
+          permission: [
+            permissions.SYSTEM_CONFIGURATION,
+            permissions.SYSTEM_CONFIGURATION_CREATE,
+            permissions.SYSTEM_CONFIGURATION_READ, 
+            permissions.SYSTEM_CONFIGURATION_UPDATE,
+            permissions.SYSTEM_CONFIGURATION_DELETE
+          ],
         },
       ],
     };
diff --git a/src/mixins/permissionsMixin.js b/src/mixins/permissionsMixin.js
index 41500353..4bf3256f 100644
--- a/src/mixins/permissionsMixin.js
+++ b/src/mixins/permissionsMixin.js
@@ -1,3 +1,4 @@
+/* eslint-disable prettier/prettier */
 import * as permissions from '../shared/permissions';
 
 export default {
@@ -7,14 +8,38 @@ export default {
         BOM_UPLOAD: permissions.BOM_UPLOAD,
         VIEW_PORTFOLIO: permissions.VIEW_PORTFOLIO,
         PORTFOLIO_MANAGEMENT: permissions.PORTFOLIO_MANAGEMENT,
-        ACCESS_MANAGEMENT: permissions.ACCESS_MANAGEMENT,
+        PORTFOLIO_MANAGEMENT_CREATE: permissions.PORTFOLIO_MANAGEMENT_CREATE,
+        PORTFOLIO_MANAGEMENT_READ: permissions.PORTFOLIO_MANAGEMENT_READ,
+        PORTFOLIO_MANAGEMENT_UPDATE: permissions.PORTFOLIO_MANAGEMENT_UPDATE,
+        PORTFOLIO_MANAGEMENT_DELETE: permissions.PORTFOLIO_MANAGEMENT_DELETE,
         VIEW_VULNERABILITY: permissions.VIEW_VULNERABILITY,
         VULNERABILITY_ANALYSIS: permissions.VULNERABILITY_ANALYSIS,
+        VULNERABILITY_ANALYSIS_CREATE: permissions.VULNERABILITY_ANALYSIS_CREATE,
+        VULNERABILITY_ANALYSIS_READ: permissions.VULNERABILITY_ANALYSIS_READ,
+        VULNERABILITY_ANALYSIS_UPDATE: permissions.VULNERABILITY_ANALYSIS_UPDATE,
         VIEW_POLICY_VIOLATION: permissions.VIEW_POLICY_VIOLATION,
         VULNERABILITY_MANAGEMENT: permissions.VULNERABILITY_MANAGEMENT,
+        VULNERABILITY_MANAGEMENT_CREATE: permissions.VULNERABILITY_MANAGEMENT_CREATE,
+        VULNERABILITY_MANAGEMENT_READ: permissions.VULNERABILITY_MANAGEMENT_READ,
+        VULNERABILITY_MANAGEMENT_UPDATE: permissions.VULNERABILITY_MANAGEMENT_UPDATE,
+        VULNERABILITY_MANAGEMENT_DELETE: permissions.VULNERABILITY_MANAGEMENT_DELETE,
         POLICY_VIOLATION_ANALYSIS: permissions.POLICY_VIOLATION_ANALYSIS,
+        ACCESS_MANAGEMENT: permissions.ACCESS_MANAGEMENT,
+        ACCESS_MANAGEMENT_CREATE: permissions.ACCESS_MANAGEMENT_CREATE,
+        ACCESS_MANAGEMENT_READ: permissions.ACCESS_MANAGEMENT_READ,
+        ACCESS_MANAGEMENT_UPDATE: permissions.ACCESS_MANAGEMENT_UPDATE,
+        ACCESS_MANAGEMENT_DELETE: permissions.ACCESS_MANAGEMENT_DELETE,
         SYSTEM_CONFIGURATION: permissions.SYSTEM_CONFIGURATION,
+        SYSTEM_CONFIGURATION_CREATE: permissions.SYSTEM_CONFIGURATION_CREATE,
+        SYSTEM_CONFIGURATION_READ: permissions.SYSTEM_CONFIGURATION_READ,
+        SYSTEM_CONFIGURATION_UPDATE: permissions.SYSTEM_CONFIGURATION_UPDATE,
+        SYSTEM_CONFIGURATION_DELETE: permissions.SYSTEM_CONFIGURATION_DELETE,
+        PROJECT_CREATION_UPLOAD: permissions.PROJECT_CREATION_UPLOAD,
         POLICY_MANAGEMENT: permissions.POLICY_MANAGEMENT,
+        POLICY_MANAGEMENT_CREATE: permissions.POLICY_MANAGEMENT_CREATE,
+        POLICY_MANAGEMENT_READ: permissions.POLICY_MANAGEMENT_READ,
+        POLICY_MANAGEMENT_UPDATE: permissions.POLICY_MANAGEMENT_UPDATE,
+        POLICY_MANAGEMENT_DELETE: permissions.POLICY_MANAGEMENT_DELETE,
       },
     };
   },
@@ -25,10 +50,35 @@ export default {
   },
   methods: {
     isPermitted(permission) {
-      return permissions.hasPermission(permission, this.decodedToken);
+      // return permissions.hasPermission(permission, this.decodedToken);
+      if (typeof permission == 'string') {
+        return permissions.hasPermission(permission, this.decodedToken);
+      }
+      else if (Array.isArray(permission)) {
+        for (let perm of permission) {
+          if (permissions.hasPermission(perm, this.decodedToken)) {
+            return true;
+          }
+        }
+        return false;
+      } else {
+        throw new Error("permission must be of type string or array")
+      }
     },
     isNotPermitted(permission) {
-      return !permissions.hasPermission(permission, this.decodedToken);
+      if (typeof permission == 'string') {
+        return !permissions.hasPermission(permission, this.decodedToken);
+      }
+      else if (Array.isArray(permission)) {
+        for (let perm of permission) {
+          if (permissions.hasPermission(perm, this.decodedToken)) {
+            return false;
+          }
+        }
+        return true;
+      } else {
+        throw new Error("permission must be of type string or array")
+      }
     },
   },
 };
diff --git a/src/router/index.js b/src/router/index.js
index 51711d69..1e2c2861 100644
--- a/src/router/index.js
+++ b/src/router/index.js
@@ -123,7 +123,7 @@ function configRoutes() {
             title: i18n.t('message.dashboard'),
             i18n: 'message.dashboard',
             sectionPath: '/dashboard',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -134,7 +134,7 @@ function configRoutes() {
             title: i18n.t('message.projects'),
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -154,7 +154,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -168,7 +168,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -182,7 +182,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -197,7 +197,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -208,7 +208,7 @@ function configRoutes() {
             title: i18n.t('message.component_search'),
             i18n: 'message.component_search',
             sectionPath: '/components',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -223,7 +223,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -234,7 +234,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.projects',
             sectionPath: '/projects',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -245,7 +245,7 @@ function configRoutes() {
             title: i18n.t('message.vulnerabilities'),
             i18n: 'message.vulnerabilities',
             sectionPath: '/vulnerabilities',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -263,7 +263,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.vulnerabilities',
             sectionPath: '/vulnerabilities',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -274,7 +274,7 @@ function configRoutes() {
             title: i18n.t('message.licenses'),
             i18n: 'message.licenses',
             sectionPath: '/licenses',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -291,7 +291,7 @@ function configRoutes() {
           meta: {
             i18n: 'message.licenses',
             sectionPath: '/licenses',
-            permission: 'VIEW_PORTFOLIO',
+            permissions: ['VIEW_PORTFOLIO'],
           },
         },
         {
@@ -307,7 +307,13 @@ function configRoutes() {
             title: i18n.t('message.policy_management'),
             i18n: 'message.policy_management',
             sectionPath: '/policy',
-            permission: 'POLICY_MANAGEMENT',
+            permissions: [
+              'POLICY_MANAGEMENT',
+              'POLICY_MANAGEMENT_CREATE',
+              'POLICY_MANAGEMENT_READ',
+              'POLICY_MANAGEMENT_UPDATE',
+              'POLICY_MANAGEMENT_DELETE'
+            ],
           },
         },
         {
@@ -317,7 +323,13 @@ function configRoutes() {
             title: i18n.t('message.administration'),
             i18n: 'message.administration',
             sectionPath: '/admin',
-            permission: 'SYSTEM_CONFIGURATION',
+            permissions: [
+              'SYSTEM_CONFIGURATION',
+              'SYSTEM_CONFIGURATION_CREATE',
+              'SYSTEM_CONFIGURATION_READ',
+              'SYSTEM_CONFIGURATION_UPDATE',
+              'SYSTEM_CONFIGURATION_DELETE'
+            ],
           },
           children: [
             {
@@ -329,7 +341,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -339,7 +357,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -349,7 +373,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -359,7 +389,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -369,7 +405,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -379,7 +421,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -389,7 +437,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -399,7 +453,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -409,7 +469,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -420,7 +486,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -430,7 +502,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -440,7 +518,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -450,7 +534,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -460,7 +550,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -471,7 +567,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -481,7 +583,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -491,7 +599,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -502,7 +616,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -512,7 +632,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -522,7 +648,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -532,7 +664,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -542,7 +680,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -552,7 +696,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -562,7 +712,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -572,7 +728,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -582,7 +744,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -592,7 +760,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -602,7 +776,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -612,7 +792,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -622,7 +808,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -633,7 +825,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -643,7 +841,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -654,7 +858,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -664,7 +874,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -674,7 +890,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'SYSTEM_CONFIGURATION',
+                permissions: [
+                  'SYSTEM_CONFIGURATION',
+                  'SYSTEM_CONFIGURATION_CREATE',
+                  'SYSTEM_CONFIGURATION_READ',
+                  'SYSTEM_CONFIGURATION_UPDATE',
+                  'SYSTEM_CONFIGURATION_DELETE'
+                ],
               },
             },
             {
@@ -685,7 +907,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
             {
@@ -695,7 +923,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
             {
@@ -705,7 +939,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
             {
@@ -715,7 +955,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
             {
@@ -725,7 +971,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
             {
@@ -735,7 +987,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
             {
@@ -745,7 +1003,13 @@ function configRoutes() {
                 title: i18n.t('message.administration'),
                 i18n: 'message.administration',
                 sectionPath: '/admin',
-                permission: 'ACCESS_MANAGEMENT',
+                permissions: [
+                  'ACCESS_MANAGEMENT',
+                  'ACCESS_MANAGEMENT_CREATE',
+                  'ACCESS_MANAGEMENT_READ',
+                  'ACCESS_MANAGEMENT_UPDATE',
+                  'ACCESS_MANAGEMENT_DELETE',
+                ],
               },
             },
           ],
@@ -762,7 +1026,7 @@ function configRoutes() {
             title: i18n.t('message.vulnerability_audit'),
             i18n: 'message.vulnerability_audit',
             sectionPath: '/globalAudit',
-            permission: 'VIEW_VULNERABILITY',
+            permissions: ['VIEW_VULNERABILITY'],
           },
         },
         // The following route redirects URLs from legacy Dependency-Track UI to new URL format.
@@ -865,11 +1129,14 @@ router.beforeEach((to, from, next) => {
     next({ name: 'Login', query: { redirect: to.fullPath }, replace: true });
   };
 
-  if (to.meta.permission) {
+  if (to.meta.permissions) {
     // non-public route, check permissions
     const jwt = getToken();
     if (jwt) {
-      if (hasPermission(to.meta.permission)) {
+      const isAllowed = to.meta.permissions.some((permission) =>
+        hasPermission(permission),
+      );
+      if (isAllowed) {
         // let backend verify the token
         router.app.axios
           .get(`${router.app.$api.BASE_URL}/${router.app.$api.URL_USER_SELF}`, {
diff --git a/src/shared/permissions.js b/src/shared/permissions.js
index 14016e65..22136541 100644
--- a/src/shared/permissions.js
+++ b/src/shared/permissions.js
@@ -1,15 +1,40 @@
+/* eslint-disable prettier/prettier */
 // API Permissions
 export const BOM_UPLOAD = 'BOM_UPLOAD';
 export const VIEW_PORTFOLIO = 'VIEW_PORTFOLIO';
 export const PORTFOLIO_MANAGEMENT = 'PORTFOLIO_MANAGEMENT';
-export const ACCESS_MANAGEMENT = 'ACCESS_MANAGEMENT';
+export const PORTFOLIO_MANAGEMENT_CREATE = 'PORTFOLIO_MANAGEMENT_CREATE';
+export const PORTFOLIO_MANAGEMENT_READ = 'PORTFOLIO_MANAGEMENT_READ';
+export const PORTFOLIO_MANAGEMENT_UPDATE = 'PORTFOLIO_MANAGEMENT_UPDATE';
+export const PORTFOLIO_MANAGEMENT_DELETE = 'PORTFOLIO_MANAGEMENT_DELETE';
 export const VIEW_VULNERABILITY = 'VIEW_VULNERABILITY';
 export const VULNERABILITY_ANALYSIS = 'VULNERABILITY_ANALYSIS';
+export const VULNERABILITY_ANALYSIS_CREATE = 'VULNERABILITY_ANALYSIS_CREATE';
+export const VULNERABILITY_ANALYSIS_READ = 'VULNERABILITY_ANALYSIS_READ';
+export const VULNERABILITY_ANALYSIS_UPDATE = 'VULNERABILITY_ANALYSIS_UPDATE';
 export const VIEW_POLICY_VIOLATION = 'VIEW_POLICY_VIOLATION';
 export const VULNERABILITY_MANAGEMENT = 'VULNERABILITY_MANAGEMENT';
+export const VULNERABILITY_MANAGEMENT_CREATE = 'VULNERABILITY_MANAGEMENT_CREATE';
+export const VULNERABILITY_MANAGEMENT_READ = 'VULNERABILITY_MANAGEMENT_READ';
+export const VULNERABILITY_MANAGEMENT_UPDATE = 'VULNERABILITY_MANAGEMENT_UPDATE';
+export const VULNERABILITY_MANAGEMENT_DELETE = 'VULNERABILITY_MANAGEMENT_DELETE';
 export const POLICY_VIOLATION_ANALYSIS = 'POLICY_VIOLATION_ANALYSIS';
+export const ACCESS_MANAGEMENT = 'ACCESS_MANAGEMENT';
+export const ACCESS_MANAGEMENT_CREATE = 'ACCESS_MANAGEMENT_CREATE';
+export const ACCESS_MANAGEMENT_READ = 'ACCESS_MANAGEMENT_READ';
+export const ACCESS_MANAGEMENT_UPDATE = 'ACCESS_MANAGEMENT_UPDATE';
+export const ACCESS_MANAGEMENT_DELETE = 'ACCESS_MANAGEMENT_DELETE';
 export const SYSTEM_CONFIGURATION = 'SYSTEM_CONFIGURATION';
+export const SYSTEM_CONFIGURATION_CREATE = 'SYSTEM_CONFIGURATION_CREATE';
+export const SYSTEM_CONFIGURATION_READ = 'SYSTEM_CONFIGURATION_READ';
+export const SYSTEM_CONFIGURATION_UPDATE = 'SYSTEM_CONFIGURATION_UPDATE';
+export const SYSTEM_CONFIGURATION_DELETE = 'SYSTEM_CONFIGURATION_DELETE';
+export const PROJECT_CREATION_UPLOAD = 'PROJECT_CREATION_UPLOAD';
 export const POLICY_MANAGEMENT = 'POLICY_MANAGEMENT';
+export const POLICY_MANAGEMENT_CREATE = 'POLICY_MANAGEMENT_CREATE';
+export const POLICY_MANAGEMENT_READ = 'POLICY_MANAGEMENT_READ';
+export const POLICY_MANAGEMENT_UPDATE = 'POLICY_MANAGEMENT_UPDATE';
+export const POLICY_MANAGEMENT_DELETE = 'POLICY_MANAGEMENT_DELETE';
 
 /**
  * Determines if the current logged in user has a specific permission.
@@ -19,7 +44,16 @@ export const POLICY_MANAGEMENT = 'POLICY_MANAGEMENT';
 export const hasPermission = function hasPermission(permission, decodedToken) {
   const token = decodedToken || decodeToken(getToken());
   const permissions = token?.permissions?.split(',') || [];
-  return permissions.includes(permission);
+  if (typeof permission == 'string') {
+    return permissions.includes(permission);
+  } else if (Array.isArray(permission)) {
+    for (let perm of permission) {
+      if (permissions.includes(perm)) {
+        return true;
+      }
+    }
+    return false;
+  }
 };
 
 /**
diff --git a/src/views/Dashboard.vue b/src/views/Dashboard.vue
index c0f3bedc..97aab83c 100644
--- a/src/views/Dashboard.vue
+++ b/src/views/Dashboard.vue
@@ -8,9 +8,10 @@
             {{ $t('message.portfolio_vulnerabilities') }}
           </h4>
           <div class="small text-muted">
+            <!-- Change below v-permission back to PORTFOLIO_MANAGEMENT -->
             {{ $t('message.last_measurement') }}: {{ lastMeasurement
             }}<b-link
-              v-permission="'PORTFOLIO_MANAGEMENT'"
+              v-permission:or="['PORTFOLIO_MANAGEMENT', 'PORTFOLIO_MANAGEMENT_READ']"
               class="font-weight-bold"
               style="margin-left: 6px"
               v-on:click="refreshMetrics"
diff --git a/src/views/administration/AdminMenu.vue b/src/views/administration/AdminMenu.vue
index 11cc143c..6ac47be9 100644
--- a/src/views/administration/AdminMenu.vue
+++ b/src/views/administration/AdminMenu.vue
@@ -45,7 +45,15 @@ import permissionsMixin from '../../mixins/permissionsMixin';
 import EventBus from '../../shared/eventbus';
 import {
   ACCESS_MANAGEMENT,
+  ACCESS_MANAGEMENT_CREATE,
+  ACCESS_MANAGEMENT_READ,
+  ACCESS_MANAGEMENT_UPDATE,
+  ACCESS_MANAGEMENT_DELETE,
   SYSTEM_CONFIGURATION,
+  SYSTEM_CONFIGURATION_CREATE,
+  SYSTEM_CONFIGURATION_READ,
+  SYSTEM_CONFIGURATION_UPDATE,
+  SYSTEM_CONFIGURATION_DELETE,
 } from '../../shared/permissions';
 
 export default {
@@ -78,7 +86,7 @@ export default {
         {
           name: this.$t('admin.configuration'),
           id: 'configuration',
-          permission: SYSTEM_CONFIGURATION,
+          permission: [SYSTEM_CONFIGURATION, SYSTEM_CONFIGURATION_CREATE, SYSTEM_CONFIGURATION_READ, SYSTEM_CONFIGURATION_UPDATE, SYSTEM_CONFIGURATION_DELETE],
           children: [
             {
               component: 'General',
@@ -125,7 +133,7 @@ export default {
         {
           name: this.$t('admin.analyzers'),
           id: 'analyzers',
-          permission: SYSTEM_CONFIGURATION,
+          permission: [SYSTEM_CONFIGURATION, SYSTEM_CONFIGURATION_CREATE, SYSTEM_CONFIGURATION_READ, SYSTEM_CONFIGURATION_UPDATE, SYSTEM_CONFIGURATION_DELETE],
           children: [
             {
               component: 'InternalAnalyzer',
@@ -157,7 +165,7 @@ export default {
         {
           name: this.$t('admin.vuln_sources'),
           id: 'vulnerabilitysources',
-          permission: SYSTEM_CONFIGURATION,
+          permission: [SYSTEM_CONFIGURATION, SYSTEM_CONFIGURATION_CREATE, SYSTEM_CONFIGURATION_READ, SYSTEM_CONFIGURATION_UPDATE, SYSTEM_CONFIGURATION_DELETE],
           children: [
             {
               component: 'VulnSourceNvd',
@@ -179,7 +187,7 @@ export default {
         {
           name: this.$t('admin.repositories'),
           id: 'repositories',
-          permission: SYSTEM_CONFIGURATION,
+          permission: [SYSTEM_CONFIGURATION, SYSTEM_CONFIGURATION_CREATE, SYSTEM_CONFIGURATION_READ, SYSTEM_CONFIGURATION_UPDATE, SYSTEM_CONFIGURATION_DELETE],
           children: [
             {
               component: 'Cargo',
@@ -251,7 +259,7 @@ export default {
         {
           name: this.$t('admin.notifications'),
           id: 'notifications',
-          permission: SYSTEM_CONFIGURATION,
+          permission: [SYSTEM_CONFIGURATION, SYSTEM_CONFIGURATION_CREATE, SYSTEM_CONFIGURATION_READ, SYSTEM_CONFIGURATION_UPDATE, SYSTEM_CONFIGURATION_DELETE],
           children: [
             {
               component: 'Alerts',
@@ -268,7 +276,7 @@ export default {
         {
           name: this.$t('admin.integrations'),
           id: 'integrations',
-          permission: SYSTEM_CONFIGURATION,
+          permission: [SYSTEM_CONFIGURATION, SYSTEM_CONFIGURATION_CREATE, SYSTEM_CONFIGURATION_READ, SYSTEM_CONFIGURATION_UPDATE, SYSTEM_CONFIGURATION_DELETE],
           children: [
             {
               component: 'DefectDojo',
@@ -295,7 +303,7 @@ export default {
         {
           name: this.$t('admin.access_management'),
           id: 'accessmanagement',
-          permission: ACCESS_MANAGEMENT,
+          permission: [ACCESS_MANAGEMENT, ACCESS_MANAGEMENT_CREATE, ACCESS_MANAGEMENT_READ, ACCESS_MANAGEMENT_UPDATE, ACCESS_MANAGEMENT_DELETE],
           children: [
             {
               component: 'LdapUsers',
diff --git a/src/views/administration/Administration.vue b/src/views/administration/Administration.vue
index 125a35d0..db71f5f5 100644
--- a/src/views/administration/Administration.vue
+++ b/src/views/administration/Administration.vue
@@ -1,5 +1,11 @@
 <template>
-  <div class="animated fadeIn" v-permission="'SYSTEM_CONFIGURATION'">
+  <div class="animated fadeIn" v-permission:or="[
+  'SYSTEM_CONFIGURATION',
+  'SYSTEM_CONFIGURATION_CREATE',
+  'SYSTEM_CONFIGURATION_READ',
+  'SYSTEM_CONFIGURATION_UPDATE',
+  'SYSTEM_CONFIGURATION_DELETE'
+  ]">
     <b-row>
       <b-col xs="6" sm="4" md="4" lg="3" id="admin-menu-column">
         <admin-menu />
diff --git a/src/views/policy/LicenseGroupList.vue b/src/views/policy/LicenseGroupList.vue
index 2a26ca2c..167007e7 100644
--- a/src/views/policy/LicenseGroupList.vue
+++ b/src/views/policy/LicenseGroupList.vue
@@ -1,11 +1,14 @@
 <template>
-  <div class="animated fadeIn" v-permission="'POLICY_MANAGEMENT'">
+  <div class="animated fadeIn" v-permission:or="['POLICY_MANAGEMENT', 'POLICY_MANAGEMENT_CREATE', 'POLICY_MANAGEMENT_READ', 'POLICY_MANAGEMENT_UPDATE', 'POLICY_MANAGEMENT_DELETE']">
     <div id="licenseGroupsToolbar" class="bs-table-custom-toolbar">
       <b-button
         size="md"
         variant="outline-primary"
         v-b-modal.createLicenseGroupModal
-        v-permission="PERMISSIONS.POLICY_MANAGEMENT"
+        v-permission:or="[
+          PERMISSIONS.POLICY_MANAGEMENT,
+          PERMISSIONS.POLICY_MANAGEMENT_CREATE
+          ]"
       >
         <span class="fa fa-plus"></span>
         {{ $t('message.create_license_group') }}
@@ -119,13 +122,13 @@ export default {
                     <b-form-group :label="this.$t('message.licenses')">
                       <div class="list-group">
                         <span v-for="license in licenses">
-                          <actionable-list-group-item :value="license.name" :delete-icon="true" v-on:actionClicked="removeLicense(license)"/>
+                          <actionable-list-group-item :value="license.name" v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_UPDATE]" :delete-icon="true" v-on:actionClicked="removeLicense(license)"/>
                         </span>
-                        <actionable-list-group-item :add-icon="true" v-on:actionClicked="$root.$emit('bv::show::modal', 'selectLicenseModal')"/>
+                        <actionable-list-group-item v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_UPDATE]" :add-icon="true" v-on:actionClicked="$root.$emit('bv::show::modal', 'selectLicenseModal')"/>
                       </div>
                     </b-form-group>
                     <div style="text-align:right">
-                       <b-button variant="outline-danger" @click="deleteLicenseGroup">{{ $t('message.delete_license_group') }}</b-button>
+                       <b-button v-permission:or="['POLICY_MANAGEMENT', 'POLICY_MANAGEMENT_DELETE']" variant="outline-danger" @click="deleteLicenseGroup">{{ $t('message.delete_license_group') }}</b-button>
                     </div>
                   </b-col>
                 </b-row>
diff --git a/src/views/policy/PolicyCondition.vue b/src/views/policy/PolicyCondition.vue
index 92a4d277..f2d7376a 100644
--- a/src/views/policy/PolicyCondition.vue
+++ b/src/views/policy/PolicyCondition.vue
@@ -1,5 +1,6 @@
 <template>
   <actionable-list-group-item
+    v-permission:or="['POLICY_MANAGEMENT', 'POLICY_MANAGEMENT_UPDATE']"
     :delete-icon="true"
     v-on:actionClicked="removeCondition()"
   >
diff --git a/src/views/policy/PolicyList.vue b/src/views/policy/PolicyList.vue
index 9b430c7b..4c0c1c86 100644
--- a/src/views/policy/PolicyList.vue
+++ b/src/views/policy/PolicyList.vue
@@ -1,11 +1,11 @@
 <template>
-  <div class="animated fadeIn" v-permission="'POLICY_MANAGEMENT'">
+  <div class="animated fadeIn" v-permission:or="['POLICY_MANAGEMENT', 'POLICY_MANAGEMENT_CREATE', 'POLICY_MANAGEMENT_READ', 'POLICY_MANAGEMENT_UPDATE', 'POLICY_MANAGEMENT_DELETE']">
     <div id="policiesToolbar" class="bs-table-custom-toolbar">
       <b-button
         size="md"
         variant="outline-primary"
         v-b-modal.createPolicyModal
-        v-permission="PERMISSIONS.POLICY_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_CREATE]"
       >
         <span class="fa fa-plus"></span> {{ $t('message.create_policy') }}
       </b-button>
@@ -140,7 +140,7 @@ export default {
                         <span v-for="(condition, conditionIndex) in conditions">
                           <policy-condition :policy="policy" :condition="condition" v-on:conditionRemoved="removeCondition(condition, conditionIndex, index)" />
                         </span>
-                        <actionable-list-group-item :add-icon="true" v-on:actionClicked="addCondition" />
+                        <actionable-list-group-item v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_UPDATE]" :add-icon="true" v-on:actionClicked="addCondition" />
                       </div>
                     </b-form-group>
                     <b-form-group v-if="limitToVisible === true" id="projectLimitsList" :label="this.$t('admin.limit_to_projects')">
@@ -148,7 +148,7 @@ export default {
                         <span v-for="project in projects">
                           <actionable-list-group-item :value="formatLabel(project.name, project.version)" :delete-icon="true" v-on:actionClicked="deleteProjectLimiter(project.uuid)"/>
                         </span>
-                        <actionable-list-group-item :add-icon="true" v-on:actionClicked="$root.$emit('bv::show::modal', 'selectProjectModal')"/>
+                        <actionable-list-group-item v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_UPDATE]" :add-icon="true" v-on:actionClicked="$root.$emit('bv::show::modal', 'selectProjectModal')"/>
                       </div>
                     </b-form-group>
                     <div v-if="limitToVisible === true" style="margin-bottom: 1.5rem">
@@ -160,13 +160,13 @@ export default {
                         <span v-for="tag in tags">
                           <actionable-list-group-item :value="formatLabel(tag.name, tag.id)" :delete-icon="true" v-on:actionClicked="deleteTagLimiter(tag.name)"/>
                         </span>
-                        <actionable-list-group-item :add-icon="true" v-on:actionClicked="$root.$emit('bv::show::modal', 'selectTagModal')"/>
+                        <actionable-list-group-item v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_UPDATE]" :add-icon="true" v-on:actionClicked="$root.$emit('bv::show::modal', 'selectTagModal')"/>
                       </div>
                     </b-form-group>
                     <div style="text-align:right">
                       <b-toggleable-display-button variant="outline-primary" :label="$t('admin.limit_to')"
                           v-permission="PERMISSIONS.VIEW_PORTFOLIO" v-on:toggle="limitToVisible = !limitToVisible" />
-                       <b-button variant="outline-danger" @click="deletePolicy">{{ $t('message.delete_policy') }}</b-button>
+                       <b-button v-permission:or="['POLICY_MANAGEMENT', 'POLICY_MANAGEMENT_DELETE']" variant="outline-danger" @click="deletePolicy">{{ $t('message.delete_policy') }}</b-button>
                     </div>
                   </b-col>
                 </b-row>
diff --git a/src/views/policy/PolicyManagement.vue b/src/views/policy/PolicyManagement.vue
index 8d34cf05..800530cc 100644
--- a/src/views/policy/PolicyManagement.vue
+++ b/src/views/policy/PolicyManagement.vue
@@ -1,5 +1,5 @@
 <template>
-  <div class="animated fadeIn" v-permission="PERMISSIONS.POLICY_MANAGEMENT">
+  <div class="animated fadeIn" v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_CREATE, PERMISSIONS.POLICY_MANAGEMENT_READ, PERMISSIONS.POLICY_MANAGEMENT_UPDATE, PERMISSIONS.POLICY_MANAGEMENT_DELETE]">
     <b-tabs
       class="body-bg-color"
       style="border-left: 0; border-right: 0; border-top: 0"
diff --git a/src/views/policy/VulnerabilityPolicyList.vue b/src/views/policy/VulnerabilityPolicyList.vue
index 7505e607..65ba3596 100644
--- a/src/views/policy/VulnerabilityPolicyList.vue
+++ b/src/views/policy/VulnerabilityPolicyList.vue
@@ -1,5 +1,5 @@
 <template>
-  <div class="animated fadeIn" v-permission="'POLICY_MANAGEMENT'">
+  <div class="animated fadeIn" v-permission:or="'POLICY_MANAGEMENT', 'POLICY_MANAGEMENT_CREATE', 'POLICY_MANAGEMENT_READ', 'POLICY_MANAGEMENT_UPDATE', 'POLICY_MANAGEMENT_DELETE'">
     <b-alert
       v-if="bundleSyncStatus === 'FAILED'"
       variant="danger"
@@ -19,7 +19,7 @@
         {{ $t('message.policy_bundle_info') }}
       </b-button>
       <b-button
-        v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT]"
+        v-permission:or="[PERMISSIONS.POLICY_MANAGEMENT, PERMISSIONS.POLICY_MANAGEMENT_UPDATE]"
         variant="outline-primary"
         @click="sync"
         :disabled="bundleSyncStatus === 'PENDING'"
diff --git a/src/views/portfolio/licenses/License.vue b/src/views/portfolio/licenses/License.vue
index 85472059..22e8db8a 100644
--- a/src/views/portfolio/licenses/License.vue
+++ b/src/views/portfolio/licenses/License.vue
@@ -97,7 +97,7 @@
       v-if="license.isCustomLicense"
       variant="outline-danger"
       @click="removeCustomLicense"
-      v-permission="PERMISSIONS.SYSTEM_CONFIGURATION"
+      v-permission:or="[PERMISSIONS.SYSTEM_CONFIGURATION, PERMISSIONS.SYSTEM_CONFIGURATION_DELETE]"
       >{{ $t('message.delete') }}</b-button
     >
   </div>
diff --git a/src/views/portfolio/licenses/LicenseList.vue b/src/views/portfolio/licenses/LicenseList.vue
index 6f034102..e7cc7d7d 100644
--- a/src/views/portfolio/licenses/LicenseList.vue
+++ b/src/views/portfolio/licenses/LicenseList.vue
@@ -6,7 +6,7 @@
         size="md"
         variant="outline-primary"
         v-b-modal.licenseAddLicenseModal
-        v-permission="PERMISSIONS.SYSTEM_CONFIGURATION"
+        v-permission:or="[PERMISSIONS.SYSTEM_CONFIGURATION, PERMISSIONS.SYSTEM_CONFIGURATION_CREATE]"
       >
         <span class="fa fa-plus"></span> {{ $t('message.add_license') }}
       </b-button>
diff --git a/src/views/portfolio/projects/ComponentDashboard.vue b/src/views/portfolio/projects/ComponentDashboard.vue
index f59da26d..e428ce0d 100644
--- a/src/views/portfolio/projects/ComponentDashboard.vue
+++ b/src/views/portfolio/projects/ComponentDashboard.vue
@@ -9,7 +9,7 @@
           <div class="small text-muted">
             {{ $t('message.last_measurement') }}: {{ lastMeasurement
             }}<b-link
-              v-permission="'PORTFOLIO_MANAGEMENT'"
+              v-permission:or="['PORTFOLIO_MANAGEMENT', 'PORTFOLIO_MANAGEMENT_READ']"
               class="font-weight-bold"
               style="margin-left: 6px"
               v-on:click="refreshMetrics"
diff --git a/src/views/portfolio/projects/ComponentDetailsModal.vue b/src/views/portfolio/projects/ComponentDetailsModal.vue
index f302ada1..9d351fd6 100644
--- a/src/views/portfolio/projects/ComponentDetailsModal.vue
+++ b/src/views/portfolio/projects/ComponentDetailsModal.vue
@@ -25,7 +25,7 @@
             :label="$t('message.component_name')"
             :tooltip="this.$t('message.component_name_desc')"
             :feedback-text="$t('message.required_component_name')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-version-input"
@@ -39,7 +39,7 @@
             :label="$t('message.version')"
             :tooltip="this.$t('message.component_version_desc')"
             :feedback-text="$t('message.required_component_version')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-group-input"
@@ -49,7 +49,7 @@
             required="false"
             :label="$t('message.component_namespace_group_vendor')"
             :tooltip="this.$t('message.component_group_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           {{ $t('message.component_classification') }}
           <b-badge
@@ -67,7 +67,7 @@
             required="false"
             :label="$t('message.component_author')"
             :tooltip="this.$t('message.component_author_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-purl-input"
@@ -77,7 +77,7 @@
             required="false"
             :label="$t('message.package_url_full')"
             :tooltip="this.$t('message.component_package_url_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-cpe-input"
@@ -87,7 +87,7 @@
             required="false"
             :label="$t('message.cpe_full')"
             :tooltip="$t('message.component_cpe_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-swidTagId-input"
@@ -97,7 +97,7 @@
             required="false"
             :label="$t('message.swid_tagid')"
             :tooltip="$t('message.component_swid_tagid_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-uuid"
@@ -128,7 +128,7 @@
             :options="availableClassifiers"
             :label="$t('message.classifier')"
             :tooltip="$t('message.component_classifier_desc')"
-            :disabled="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :disabled="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-filename-input"
@@ -138,7 +138,7 @@
             required="false"
             :label="$t('message.filename')"
             :tooltip="$t('message.component_filename_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-form-group
             id="component-description-form-group"
@@ -149,7 +149,7 @@
               id="component-description-description"
               v-model="component.description"
               rows="3"
-              :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+              :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
             />
           </b-form-group>
         </b-card>
@@ -167,7 +167,7 @@
             :options="selectableLicenses"
             :label="$t('message.license')"
             :tooltip="$t('message.component_spdx_license_desc')"
-            :disabled="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :disabled="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-license-expression"
@@ -177,7 +177,7 @@
             required="false"
             :label="$t('message.license_expression')"
             :tooltip="$t('message.component_license_expression_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-license-url-input"
@@ -187,7 +187,7 @@
             required="false"
             :label="$t('message.license_url')"
             :tooltip="$t('message.component_license_url_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-form-group
             id="component-copyright-form-group"
@@ -198,7 +198,7 @@
               id="component-description-description"
               v-model="component.copyright"
               rows="3"
-              :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+              :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
             />
           </b-form-group>
         </b-card>
@@ -216,7 +216,7 @@
             required="false"
             :label="$t('hashes.md5')"
             :tooltip="$t('message.component_hash_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-sha1-input"
@@ -226,7 +226,7 @@
             required="false"
             :label="$t('hashes.sha_1')"
             :tooltip="$t('message.component_hash_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-sha256-input"
@@ -236,7 +236,7 @@
             required="false"
             :label="$t('hashes.sha_256')"
             :tooltip="$t('message.component_hash_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-sha512-input"
@@ -246,7 +246,7 @@
             required="false"
             :label="$t('hashes.sha_512')"
             :tooltip="$t('message.component_hash_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-sha3256-input"
@@ -256,7 +256,7 @@
             required="false"
             :label="$t('hashes.sha3_256')"
             :tooltip="$t('message.component_hash_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="component-sha3512-input"
@@ -266,7 +266,7 @@
             required="false"
             :label="$t('hashes.sha3_512')"
             :tooltip="$t('message.component_hash_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
         </b-card>
       </b-tab>
@@ -349,7 +349,7 @@
               id="component-notes-description"
               v-model="component.notes"
               rows="3"
-              :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+              :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
             />
           </b-form-group>
         </b-card>
@@ -360,14 +360,14 @@
         size="md"
         variant="outline-danger"
         @click="deleteComponent()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_DELETE]"
         >{{ $t('message.delete') }}</b-button
       >
       <b-button
         size="md"
         variant="outline-primary"
         v-b-modal.componentPropertiesModal
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >{{ $t('message.properties') }}</b-button
       >
       <b-button size="md" variant="secondary" @click="cancel()">{{
@@ -377,7 +377,7 @@
         size="md"
         variant="primary"
         @click="updateComponent()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >{{ $t('message.update') }}</b-button
       >
     </template>
diff --git a/src/views/portfolio/projects/FindingAudit.vue b/src/views/portfolio/projects/FindingAudit.vue
index 2668c078..21334577 100644
--- a/src/views/portfolio/projects/FindingAudit.vue
+++ b/src/views/portfolio/projects/FindingAudit.vue
@@ -130,7 +130,7 @@
       </b-form-group>
       <b-form-group
         id="fieldset-8"
-        v-if="this.isPermitted(this.PERMISSIONS.VULNERABILITY_ANALYSIS)"
+        v-if="this.isPermitted([this.PERMISSIONS.VULNERABILITY_ANALYSIS, this.PERMISSIONS.VULNERABILITY_ANALYSIS_UPDATE])"
         :label="this.$t('message.comment')"
         label-for="input-8"
       >
@@ -150,7 +150,7 @@
       </b-form-group>
       <b-form-group
         id="fieldset-9"
-        v-if="this.isPermitted(this.PERMISSIONS.VULNERABILITY_ANALYSIS)"
+        v-if="this.isPermitted([this.PERMISSIONS.VULNERABILITY_ANALYSIS, this.PERMISSIONS.VULNERABILITY_ANALYSIS_UPDATE])"
         :label="this.$t('message.analysis')"
         label-for="input-9"
       >
@@ -175,7 +175,7 @@
           />
         </b-input-group>
       </b-form-group>
-      <b-row v-if="this.isPermitted(this.PERMISSIONS.VULNERABILITY_ANALYSIS)">
+      <b-row v-if="this.isPermitted([this.PERMISSIONS.VULNERABILITY_ANALYSIS, this.PERMISSIONS.VULNERABILITY_ANALYSIS_UPDATE])">
         <b-col sm="6">
           <b-form-group
             id="fieldset-10"
@@ -217,7 +217,7 @@
       </b-row>
       <b-form-group
         id="fieldset-12"
-        v-if="this.isPermitted(this.PERMISSIONS.VIEW_VULNERABILITY)"
+        v-if="this.isPermitted([this.PERMISSIONS.VULNERABILITY_ANALYSIS, this.PERMISSIONS.VULNERABILITY_ANALYSIS_UPDATE])"
         :label="this.$t('message.details')"
         label-for="analysisDetailsField"
       >
@@ -228,7 +228,7 @@
           class="form-control"
           :disabled="
             analysisState === null ||
-            !this.isPermitted(this.PERMISSIONS.VULNERABILITY_ANALYSIS)
+            !this.isPermitted([this.PERMISSIONS.VULNERABILITY_ANALYSIS, this.PERMISSIONS.VULNERABILITY_ANALYSIS_UPDATE])
           "
           v-b-tooltip.hover
           :title="this.$t('message.analysis_details_tooltip')"
diff --git a/src/views/portfolio/projects/ProjectAddComponentModal.vue b/src/views/portfolio/projects/ProjectAddComponentModal.vue
index aa8e07bb..6207bc20 100644
--- a/src/views/portfolio/projects/ProjectAddComponentModal.vue
+++ b/src/views/portfolio/projects/ProjectAddComponentModal.vue
@@ -245,7 +245,7 @@
         size="md"
         variant="primary"
         @click="createComponent()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >{{ $t('message.create') }}</b-button
       >
     </template>
diff --git a/src/views/portfolio/projects/ProjectComponents.vue b/src/views/portfolio/projects/ProjectComponents.vue
index 3aba71ea..66438d5b 100644
--- a/src/views/portfolio/projects/ProjectComponents.vue
+++ b/src/views/portfolio/projects/ProjectComponents.vue
@@ -6,7 +6,7 @@
           size="md"
           variant="outline-primary"
           v-b-modal.projectAddComponentModal
-          v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+          v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >
           <span class="fa fa-plus"></span> {{ $t('message.add_component') }}
         </b-button>
@@ -14,7 +14,7 @@
           size="md"
           variant="outline-primary"
           @click="removeDependencies"
-          v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+          v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_DELETE]"
         >
           <span class="fa fa-minus"></span> {{ $t('message.remove_component') }}
         </b-button>
@@ -23,10 +23,7 @@
           size="md"
           variant="outline-primary"
           v-b-modal.projectUploadBomModal
-          v-permission:or="[
-            PERMISSIONS.PORTFOLIO_MANAGEMENT,
-            PERMISSIONS.BOM_UPLOAD,
-          ]"
+          v-permission="PERMISSIONS.BOM_UPLOAD"
         >
           <span class="fa fa-upload"></span> {{ $t('message.upload_bom') }}
         </b-button>
diff --git a/src/views/portfolio/projects/ProjectDashboard.vue b/src/views/portfolio/projects/ProjectDashboard.vue
index f3b25aad..6577df0e 100644
--- a/src/views/portfolio/projects/ProjectDashboard.vue
+++ b/src/views/portfolio/projects/ProjectDashboard.vue
@@ -16,7 +16,7 @@
               <td>
                 {{ lastMeasurement }}
                 <b-link
-                  v-permission="'PORTFOLIO_MANAGEMENT'"
+                  v-permission:or="['PORTFOLIO_MANAGEMENT', 'PORTFOLIO_MANAGEMENT_READ']"
                   class="font-weight-bold"
                   style="margin-left: 6px"
                   v-on:click="refreshMetrics"
diff --git a/src/views/portfolio/projects/ProjectDetailsModal.vue b/src/views/portfolio/projects/ProjectDetailsModal.vue
index 385cf791..e2737d1d 100644
--- a/src/views/portfolio/projects/ProjectDetailsModal.vue
+++ b/src/views/portfolio/projects/ProjectDetailsModal.vue
@@ -27,7 +27,7 @@
             :tooltip="this.$t('message.project_name_desc')"
             :feedback-text="$t('message.required_project_name')"
             v-on:change="syncReadOnlyNameField"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="project-version-input"
@@ -41,7 +41,7 @@
             v-on:change="syncReadOnlyVersionField"
             :label="$t('message.version')"
             :tooltip="this.$t('message.component_version_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-select
             id="v-classifier-input"
@@ -50,7 +50,7 @@
             :options="availableClassifiers"
             :label="$t('message.classifier')"
             :tooltip="$t('message.component_classifier_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <div style="margin-bottom: 1rem">
             <label>Parent</label>
@@ -81,7 +81,7 @@
               id="project-description-description"
               v-model="project.description"
               rows="3"
-              :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+              :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
             />
           </b-form-group>
           <b-form-group
@@ -97,7 +97,7 @@
               :placeholder="$t('message.add_tag')"
               @tags-changed="(newTags) => (this.tags = newTags)"
               class="mw-100 bg-transparent text-lowercase"
-              :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+              :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
             />
           </b-form-group>
           <c-switch
@@ -107,7 +107,7 @@
             v-model="project.active"
             label
             :disabled="
-              this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT) ||
+              this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]) ||
               (project.active && this.hasActiveChild(project))
             "
             v-bind="labelIcon"
@@ -174,7 +174,7 @@
             required="false"
             :label="$t('message.component_namespace_group_vendor')"
             :tooltip="this.$t('message.component_group_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="project-purl-input"
@@ -184,7 +184,7 @@
             required="false"
             :label="$t('message.package_url_full')"
             :tooltip="this.$t('message.component_package_url_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="project-cpe-input"
@@ -194,7 +194,7 @@
             required="false"
             :label="$t('message.cpe_full')"
             :tooltip="$t('message.component_cpe_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="project-swidTagId-input"
@@ -204,7 +204,7 @@
             required="false"
             :label="$t('message.swid_tagid')"
             :tooltip="$t('message.component_swid_tagid_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
         </b-card>
       </b-tab>
@@ -411,21 +411,21 @@
         size="md"
         variant="outline-danger"
         @click="deleteProject()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_DELETE]"
         >{{ $t('message.delete') }}</b-button
       >
       <b-button
         size="md"
         variant="outline-primary"
         v-b-modal.projectPropertiesModal
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >{{ $t('message.properties') }}</b-button
       >
       <b-button
         size="md"
         variant="outline-primary"
         v-b-modal.projectAddVersionModal
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_CREATE]"
         >{{ $t('message.add_version') }}</b-button
       >
       <b-button size="md" variant="secondary" @click="cancel()">{{
@@ -435,7 +435,7 @@
         size="md"
         variant="primary"
         @click="updateProject()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >{{ $t('message.update') }}</b-button
       >
     </template>
diff --git a/src/views/portfolio/projects/ProjectFindings.vue b/src/views/portfolio/projects/ProjectFindings.vue
index c805c1ed..dc44ef14 100644
--- a/src/views/portfolio/projects/ProjectFindings.vue
+++ b/src/views/portfolio/projects/ProjectFindings.vue
@@ -11,8 +11,8 @@
         variant="outline-primary"
         v-b-modal.projectUploadVexModal
         v-permission:or="[
-          PERMISSIONS.VIEW_VULNERABILITY,
           PERMISSIONS.VULNERABILITY_ANALYSIS,
+          PERMISSIONS.VULNERABILITY_ANALYSIS_CREATE,
         ]"
       >
         <span class="fa fa-upload"></span> {{ $t('message.apply_vex') }}
@@ -29,6 +29,7 @@
         v-permission:or="[
           PERMISSIONS.VIEW_VULNERABILITY,
           PERMISSIONS.VULNERABILITY_ANALYSIS,
+          PERMISSIONS.VULNERABILITY_ANALYSIS_READ,
         ]"
       >
         <span class="fa fa-download"></span> {{ $t('message.export_vex') }}
@@ -45,6 +46,7 @@
         v-permission:or="[
           PERMISSIONS.VIEW_VULNERABILITY,
           PERMISSIONS.VULNERABILITY_ANALYSIS,
+          PERMISSIONS.VULNERABILITY_ANALYSIS_READ,
         ]"
       >
         <span class="fa fa-download"></span> {{ $t('message.export_vdr') }}
diff --git a/src/views/portfolio/projects/ProjectList.vue b/src/views/portfolio/projects/ProjectList.vue
index fe15bcf0..da116274 100644
--- a/src/views/portfolio/projects/ProjectList.vue
+++ b/src/views/portfolio/projects/ProjectList.vue
@@ -6,7 +6,7 @@
         size="md"
         variant="outline-primary"
         @click="initializeProjectCreateProjectModal"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_CREATE]"
       >
         <span class="fa fa-plus"></span> {{ $t('message.create_project') }}
       </b-button>
diff --git a/src/views/portfolio/projects/ProjectPropertiesModal.vue b/src/views/portfolio/projects/ProjectPropertiesModal.vue
index f5dbeae0..8b28c3b6 100644
--- a/src/views/portfolio/projects/ProjectPropertiesModal.vue
+++ b/src/views/portfolio/projects/ProjectPropertiesModal.vue
@@ -14,7 +14,7 @@
     >
     </bootstrap-table>
     <template v-slot:modal-footer="{ cancel }">
-      <b-button size="md" variant="outline-danger" @click="deleteProperty">{{
+      <b-button v-permission:or="['PORTFOLIO_MANAGEMENT', 'PORTFOLIO_MANAGEMENT_DELETE']" size="md" variant="outline-danger" @click="deleteProperty">{{
         $t('message.delete')
       }}</b-button>
       <b-button size="md" variant="secondary" @click="cancel()">{{
diff --git a/src/views/portfolio/projects/ServiceDashboard.vue b/src/views/portfolio/projects/ServiceDashboard.vue
index 892df1e8..6c7b2fcb 100644
--- a/src/views/portfolio/projects/ServiceDashboard.vue
+++ b/src/views/portfolio/projects/ServiceDashboard.vue
@@ -9,7 +9,7 @@
           <div class="small text-muted">
             {{ $t('message.last_measurement') }}: {{ lastMeasurement
             }}<b-link
-              v-permission="'PORTFOLIO_MANAGEMENT'"
+              v-permission:or="['PORTFOLIO_MANAGEMENT', 'PORTFOLIO_MANAGEMENT_READ']"
               class="font-weight-bold"
               style="margin-left: 6px"
               v-on:click="refreshMetrics"
diff --git a/src/views/portfolio/projects/ServiceDetailsModal.vue b/src/views/portfolio/projects/ServiceDetailsModal.vue
index 2c9f215d..311174eb 100644
--- a/src/views/portfolio/projects/ServiceDetailsModal.vue
+++ b/src/views/portfolio/projects/ServiceDetailsModal.vue
@@ -24,7 +24,7 @@
             :label="$t('message.service_name')"
             :tooltip="this.$t('message.service_name_desc')"
             :feedback-text="$t('message.required_service_name')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="service-version-input"
@@ -34,7 +34,7 @@
             required="false"
             :label="$t('message.version')"
             :tooltip="this.$t('message.service_version_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-input-group-form-input
             id="service-group-input"
@@ -44,7 +44,7 @@
             required="false"
             :label="$t('message.component_namespace_group_vendor')"
             :tooltip="this.$t('message.component_group_desc')"
-            :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+            :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
           />
           <b-form-group
             id="service-notes-form-group"
@@ -55,7 +55,7 @@
               id="service-notes-description"
               v-model="service.description"
               rows="3"
-              :readonly="this.isNotPermitted(PERMISSIONS.PORTFOLIO_MANAGEMENT)"
+              :readonly="this.isNotPermitted([PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE])"
             />
           </b-form-group>
           <b-input-group-form-input
@@ -168,7 +168,7 @@
         size="md"
         variant="outline-danger"
         @click="deleteService()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_DELETE]"
         >{{ $t('message.delete') }}</b-button
       >
       <b-button size="md" variant="secondary" @click="cancel()">{{
@@ -178,7 +178,7 @@
         size="md"
         variant="primary"
         @click="updateService()"
-        v-permission="PERMISSIONS.PORTFOLIO_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.PORTFOLIO_MANAGEMENT, PERMISSIONS.PORTFOLIO_MANAGEMENT_UPDATE]"
         >{{ $t('message.update') }}</b-button
       >
     </template>
diff --git a/src/views/portfolio/vulnerabilities/VulnerabilityDetailsModal.vue b/src/views/portfolio/vulnerabilities/VulnerabilityDetailsModal.vue
index f2ac127f..498539f9 100644
--- a/src/views/portfolio/vulnerabilities/VulnerabilityDetailsModal.vue
+++ b/src/views/portfolio/vulnerabilities/VulnerabilityDetailsModal.vue
@@ -124,7 +124,7 @@
                 class="mw-100 bg-transparent text-lowercase"
                 style="min-width: 90%"
                 :readonly="
-                  this.isNotPermitted(PERMISSIONS.VULNERABILITY_MANAGEMENT)
+                  this.isNotPermitted([PERMISSIONS.VULNERABILITY_MANAGEMENT, PERMISSIONS.VULNERABILITY_MANAGEMENT_UPDATE])
                 "
               />
               <b-input-group-append v-show="isReadonly">
@@ -133,7 +133,7 @@
                     size="md"
                     variant="primary"
                     @click="updateVulnerabilityTags()"
-                    v-permission="PERMISSIONS.VULNERABILITY_MANAGEMENT"
+                    v-permission:or="[PERMISSIONS.VULNERABILITY_MANAGEMENT, PERMISSIONS.VULNERABILITY_MANAGEMENT_UPDATE]"
                   >
                     {{ $t('message.update') }}
                   </b-button>
@@ -968,7 +968,7 @@
           vulnerability.components && vulnerability.components.length > 0
         "
         v-show="!isReadonly"
-        v-permission="PERMISSIONS.VULNERABILITY_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.VULNERABILITY_MANAGEMENT, PERMISSIONS.VULNERABILITY_MANAGEMENT_DELETE]"
         >{{ $t('message.delete') }}</b-button
       >
       <b-button size="md" variant="secondary" @click="cancel()">{{
@@ -979,7 +979,7 @@
         variant="primary"
         @click="updateVulnerability()"
         v-show="!isReadonly"
-        v-permission="PERMISSIONS.VULNERABILITY_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.VULNERABILITY_MANAGEMENT, PERMISSIONS.VULNERABILITY_MANAGEMENT_UPDATE]"
         >{{ $t('message.update') }}</b-button
       >
     </template>
@@ -1685,7 +1685,7 @@ export default {
     },
     isReadonly() {
       return (
-        this.isNotPermitted(this.PERMISSIONS.VULNERABILITY_MANAGEMENT) ||
+        this.isNotPermitted([this.PERMISSIONS.VULNERABILITY_MANAGEMENT, this.PERMISSIONS.VULNERABILITY_MANAGEMENT_UPDATE]) ||
         this.vulnerability.source !== 'INTERNAL'
       );
     },
diff --git a/src/views/portfolio/vulnerabilities/VulnerabilityList.vue b/src/views/portfolio/vulnerabilities/VulnerabilityList.vue
index b087dd08..fefa5647 100644
--- a/src/views/portfolio/vulnerabilities/VulnerabilityList.vue
+++ b/src/views/portfolio/vulnerabilities/VulnerabilityList.vue
@@ -6,7 +6,7 @@
         size="md"
         variant="outline-primary"
         v-b-modal.vulnerabilityCreateVulnerabilityModal
-        v-permission="PERMISSIONS.VULNERABILITY_MANAGEMENT"
+        v-permission:or="[PERMISSIONS.VULNERABILITY_MANAGEMENT, PERMISSIONS.VULNERABILITY_MANAGEMENT_CREATE]"
       >
         <span class="fa fa-plus"></span>
         {{ $t('message.create_vulnerability') }}