CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass 6.9 Medium
- dataease DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload 6.9 Medium
- openbmb internet of agents OpenBMB Internet of Agents Message app.py fetch_chat_record access control 6.9 Medium
- unknown advanced custom fields (acf®) Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path 2.7 Low
- nexmoe vidbee nexmoe VidBee Local HTTP Service local-api.ts information disclosure 5.3 Medium
-
github.com/canonical/lxdGo LXD has project restriction bypass for custom volume copy across projects 7.7 High -
github.com/canonical/lxdGo LXD has project restriction bypass in instance copy across projects 7.7 High - freescout-help-desk freescout FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save 7.1 High
- apache software foundation james Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol No score
- ruben garcia automatorwp AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback 5.6 Medium
- open-emr openemr OpenEMR: Arbitrary Patient Recall and Contact Detail Read 7.1 High
- open-emr openemr OpenEMR: Patient Data Search Without Sufficient ACL 7.1 High
- tassos.gr advanced custom fields extension for joomla, smile pack extension for joomla +1 more Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 6.9 Medium
- hedgedoc HedgeDoc: Missing validation of incoming permission values on change 5.9 Medium
- immich-app immich Immich calendar heatmap endpoint discloses cross-user activity through broken access control 4.3 Medium
- g5theme essential real estate Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure 5.3 Medium
- g5theme essential real estate Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending 5.3 Medium
- unknown subscriptions for woocommerce Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass 5.3 Medium
- invoiceshelf InvoiceShelf MemberService.php create access control 5.1 Medium
- purocean yank note purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure 6.9 Medium
- campcodes complete advance loan management system Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload 6.9 Medium
- nst labs tech nstbrowser NST Labs Tech Nstbrowser Local Agent API info information disclosure 5.3 Medium
- xerrors yuxi Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise 9.9 Critical
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 6.5 Medium
- unknown wp roster WP Roster < 2.36 - Unauthenticated Roster Data Modification 5.3 Medium
- unknown wpvivid — backup, migration & staging WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID 6.5 Medium
- masaakitanaka booking package Booking Package < 1.7.34 - Unauthenticated Payment Bypass 5.3 Medium
- linksys e5600 Linksys E5600 Factory Quality Control fqc.cgi information disclosure 6.9 Medium
- miroslavpejic85 mirotalk p2p miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control 5.3 Medium
- No product listed Headless CMS Plugin REST API post get_required_post_data information disclosure 6.9 Medium
- surrealdb SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations 7.1 High
- zohocorp eventlog analyzer, log360 +1 more Authentication Bypass 7.5 High
- zohocorp eventlog analyzer, log360 +1 more Improper Access Control vulnerability 9.1 Critical
- unknown dt lms DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation 5.3 Medium
- echohs geekezbrowser EchoHS GeekezBrowser Public API status information disclosure 4.8 Medium
- eclipse foundation threadx User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own 6.9 Medium
- mcphub samanhappy MCPHub passthroughHeaders.ts information disclosure 5.3 Medium
- ag-ui-protocol ag-ui ag-ui-protocol ag-ui HttpAgent http.ts information disclosure 6.9 Medium
- gitea Gitea public-only token bypass in repository and organization creation 7.5 High
- gitea Gitea private repository listing to public-only tokens on profiles 4.3 Medium
- gitea Gitea admin API public-only token scope bypass 6.5 Medium
- presenton Presenton Desktop Authentication Middleware app_data information disclosure 6.9 Medium
- google android In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to... 8.4 High
- google android In multiple locations, there is a possible method for a primary user to disable secure nfc on... 8.4 High
- delinea secret server (on-prem) Secret Server device validation error 9.4 Critical
- 37954679 cak-filemanagement-system 37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload 6.9 Medium
- tigroumeow database cleaner: cleanup, optimization & repair Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion 8.7 High
- socfortress copilot SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user) 8.5 High
- eset spol. s.r.o. endpoint encryption, full disk encryption, eset, spol. s r.o. eset endpoint encryption +1 more +3 more Improper access control vulnerability in ESET Encryption products for Windows 8.5 High
- cloud foundry capi (cloud controller api), cf-deployment +1 more Broken access control restriction in Cloud Controller API 8.8 High
- Show olderLoading…