CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote...8.8 High
- openclawOpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass6.0 Medium
- cisco adaptive security appliance software, secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software +1 more +3 moreCisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability5.8 Medium
- cisco secure firewall threat defense (ftd) software, secure firewall threat defense +1 moreCisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass Vulnerability5.8 Medium
openclawnpmOpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch5.3 Medium- openclawOpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds8.3 High
- openclawOpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass7.6 High
- openclawOpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run6.0 Medium
openclawnpmOpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs8.9 High- openclawOpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox7.1 High
- weintek easyweb, cmt-3072xh2 firmware +1 moreIncorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS...6.5 Medium
- weintek easyweb, cmt-3072xh2 firmware +1 moreIncorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web...7.5 High
- openclawOpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter9.3 Critical
- openclawOpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn7.7 High
- olivetinOliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login7.5 High
- dataease sqlbotDataease SQLBot API Endpoint assistant.py access control5.3 Medium
- google androidThe register protection of the PowerVR GPU is incorrectly configured. This could lead to local...4.0 Medium
- google androidIn setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due...6.2 Medium
- google androidIn multiple functions of ContentProvider.java, there is a possible way for an app with read-only...8.4 High
- gradio-app gradioGradio has Open Redirect in OAuth Flow4.3 Medium
- redhat keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.9 +4 more +6 moreOrg.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators4.9 Medium
- psi-probe psi probepsi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control5.3 Medium
- morelitea initiativeInitiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint7.5 High
- steve-community steveIn SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)5.7 Medium
- n8nn8n - SSO Enforcement Bypass via API6.0 Medium
- hoppscotchhoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover9.1 Critical
- umbraco umbraco.engage.formsUmbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints7.5 High
- discourseDiscourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution5.3 Medium
- discourseDIscourse has DM communication-preference bypass when adding members1.3 Low
- ajentiAjenti has a potential Remote Code Execution8.1 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion5.3 Medium
- bitnami sealed-secretssealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations4.9 Medium
- fosrl pangolinfosrl Pangolin Role verifyApiKeyRoleAccess access control5.3 Medium
- feiyuchuixue sz-boot-parentfeiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload5.3 Medium
- coturnCoturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL7.2 High
- open-emr openemrOpenEMR has Broken Access Control that allows unauthorized access to EDI Logs6.5 Medium
- imagemagickImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access5.9 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape in the Storage: IndexedDB component10.0 Critical
- gcomtw gcom epon 1ge firmwarePrivilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote...8.8 High
- shuoren smart heating integrated management platformShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted upload6.9 Medium
- munyweki student result management systemSourceCodester Student Result Management System Bulk Import import_users.php access control6.9 Medium
- fastapiadminFastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload5.3 Medium
- fastapiadminFastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload5.3 Medium
- fastapiadminFastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload5.3 Medium
- fastapiadminFastApiAdmin Download Endpoint controller.py download_controller information disclosure5.3 Medium
- fastapiadminFastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure6.9 Medium
- munyweki student result management systemSourceCodester Student Result Management System update_smtp.php access control6.9 Medium
- funadminfunadmin forget.html getMember information disclosure6.9 Medium
- frappe erpnextERP: Document access through endpoints due to missing validation9.3 Critical
- foswikiFoswiki Changes/Viewfile/Oops information disclosure6.9 Medium
- Show moreLoading…