What private data can apps access without any specified permissions? Let's say an app doesn't require any permissions at all. What could that app access that could be a potential privacy risk? Other app usage? List of installed apps? Check is my screen unlocked? Google Analytics?
Permissions change with practically with every Android version , so without specifying the Android version, it is difficult to answer. Notwithstanding that, for a primer on permissions and to see how how crazy, it actually is, see The Android authorization model: a perfidious construct 


Sourced from Izzy's blog (thanks) 

*Permissions do not define what all an app can access, which is covered in Irfan's answer. Also see Izzy's primer on permissions


App description of XPrivacy Lua, which is an Xposed module, to protect privacy. Information below can be accessed without permissions (readers are welcome to add)



  
  Use analytics (Fabric/Crashlytics, Facebook
  app events, Firebase Analytics, Google Analytic, Mixpanel, Segment)
  Usetracking ( user agent for WebView only, Build properties,
  network/SIM country/operator)