CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- yeqifu warehouseyeqifu warehouse Sales Endpoint SalesController.java deleteSales access control5.3 Medium
- yeqifu warehouseyeqifu warehouse Inport Endpoint InportController.java deleteInport access control5.3 Medium
- yeqifu warehouseyeqifu warehouse Customer Endpoint CustomerController.java deleteCustomer access control5.3 Medium
- yeqifu warehouseyeqifu warehouse Cache Sync CacheController.java syncCache access control5.3 Medium
- tassos.gr advanced custom fields, convert forms, engagebox +3 more +5 moreExtension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla9.5 Critical
- frappe learning, lms +1 moreFrappe Learning Management System exposes details of unpublished courses to unauthorized users6.9 Medium
- microsoft teamsMicrosoft Teams Information Disclosure Vulnerability8.2 High
- monetizemore advanced ads – ad manager & adsenseAdvanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update4.3 Medium
- tsinghua unigroup electronic archives systemTsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload6.9 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform User delete access control6.9 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform User add access control6.9 Medium
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform api access control6.9 Medium
- mingsoft mcmsmingSoft MCMS Template Archive uploadTemplate.do unrestricted upload5.1 Medium
- huanzi-qch base-adminhuanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload5.3 Medium
- openclawOpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization6.9 Medium
- openclawOpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity8.2 High
- openclaw, clawdbot +1 moreOpenClaw iMessage group allowlist authorization inherited DM pairing-store identities6.5 Medium
- phpgurukul hospital management systemPHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low...8.8 High
- ibm cloud pak systemImproper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System[, ]4.3 Medium
- openclawOpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals7.2 High
- hewlett packard enterprise (hpe) hpe aruba networking private 5g core, hpe aruba networking private 5g core +1 moreUnauthenticated Authentication Bypass in application API allows unauthorized administrative account creation8.8 High
- gogsGogs Authorization Bypass Allows Cross-Repository Label Modification5.3 Medium
github.com/pterodactyl/wingsGo,pterodactyl/panelPackagist +1 morePterodactyl Panel's SFTP sessions remain active after user account deletion or password change7.5 High- openclawOpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl6.3 Medium
- openclawOpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path7.1 High
- zarinpal gatewayZarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update7.7 High
- efm iptime a6004mxEFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload9.3 Critical
- zhanghuanhao librarysystem 图书馆管理系统zhanghuanhao LibrarySystem 图书馆管理系统 BookController.java access control6.9 Medium
- lavaliteLavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low...8.8 High
- dell idrac service module, idrac service module for linux +1 moreDell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service...7.8 High
- No product listedCross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker...9.0 Critical
- infoblox niosIn Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via...7.7 High
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 26...7.1 High
- apple ipados, ios and ipados, iphone os +2 moreAn input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A...2.4 Low
- apple macosThis issue was addressed with improved redaction of sensitive information. This issue is fixed in...4.4 Medium
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3...5.5 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...3.3 Low
- metis cyberspace technology sa wicUnauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC7.5 High
- dinosoft business solutions erpImproper Access Control in Dinosoft Business Solutions' Dinosoft ERP9.8 Critical
- amd epyc™ 7003 series processors, epyc™ 8004 series processors, epyc™ 9004 series processors +6 more +8 moreImproper access control in secure encrypted virtualization (SEV) could allow a privileged...6.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Hyper-V Security Feature Bypass Vulnerability8.8 High
- tp-link systems inc. tapo c260 v1, tp-link tapo c260 firmware, tp-link systems inc. tapo d235 v1 +2 moreInsecure Access Control on TP-Link Tapo D235 and C2607.2 High
- error311 fileriseFileRise affected by an Unauthenticated File Read Due to Insufficient Access Control7.5 High
- douco douphpDouPHP ZIP File file.php unrestricted upload5.1 Medium
- code-projects online music sitecode-projects Online Music Site AdminAddAlbum.php unrestricted upload5.1 Medium
- great developers certificate generation system, greatdevelopers certificate +1 moreGreat Developers Certificate Generation System csv.php unrestricted upload5.3 Medium
- cradle e-commercedetronetdip E-commerce addadhar.php unrestricted upload6.9 Medium
- tenda ac21, ac21 firmware +1 moreTenda AC21 Web Management DownloadFlash information disclosure6.9 Medium
- tenda ac21, ac21 firmware +1 moreTenda AC21 Web Management DownloadLog information disclosure6.9 Medium
- Show moreLoading…