Is it legal for a company to pull my credit report without my permission and without a "permissible purpose"?

No, it is a violation of the Fair Credit Reporting Act (FCRA) for a company or person to obtain your credit reports, unless they have your permission, or unless they have a "permissible purpose" under the law.

If this occurs, you have the right to bring suit, to have your attorney fees paid, and to be paid $1000 as statutory damages.

A recent court case by the 5th Circuit Court of Appeals threw out a case, because it wasn't brought within the statute of limitations for such suits, which is 2 years from the date the credit report was received. Mack v. Equable Ascent Financial, LLC, 5th Cir. 2014.