CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed...7.5 High
- wintercms winterWinter: Privilege escalation by authenticated backend users10.0 Critical
- olivetinOliveTin Unauthorized Action Output Disclosure via EventStream7.1 High
- dell alienware command center (awcc), alienware command center +1 moreDell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access...3.6 Low
- taskosaurTaskosaur Improper Role Assignment via Parameter Manipulation in User Registration9.8 Critical
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api4.2 Medium
- maykinmedia open forms, open-formulieren open-forms +1 moreOpen Forms possible to view submission details of other people than intended6.5 Medium
- parse-community parse-serverParse Server has a protected fields bypass via dot-notation in query and sort8.7 High
- No product listedIn Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace...8.8 High
- No product listedInsecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0...9.9 Critical
- umbraco cms, umbraco-cms +1 moreUmbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks7.2 High
- django-commons django-unicorn, django-unicorn unicorn +1 moredjango-unicorn affected by component state manipulation via unvalidated attribute access5.3 Medium
- parse-community parse-serverParse Server role escalation and CLP bypass via direct `_Join` table write10.0 Critical
- parse-community parse-serverParse Server has a protected fields bypass via logical query operators7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +19 more +21 moreWindows Projected File System Elevation of Privilege Vulnerability7.8 High
- microsoft windows admin center in azure portal, windows admin center +1 moreWindows Admin Center in Azure Portal Elevation of Privilege Vulnerability7.8 High
- microsoft sql server 2016 service pack 3 (gdr), sql server 2016 service pack 3 azure connect feature pack, sql server 2017 (cu 31) +12 more +14 moreSQL Server Elevation of Privilege Vulnerability8.8 High
- fortinet fortiswitchaxfixedAn improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may...5.1 Medium
- vaadin, nextcloud flow +1 moreUnauthorized session creation via reserved framework path access5.3 Medium
- openclawOpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command5.8 Medium
- freshrssFreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens7.5 High
- b3log siyuanSiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content7.1 High
- janobe resort reservation systemSourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload5.3 Medium
- tiandy video surveillance system 视频监控平台, video surveillance system firmware +1 moreTiandy Video Surveillance System 视频监控平台 CLS_REST_File.java uploadFile unrestricted upload5.3 Medium
- qi-anxin qax virus removal, qianxin qax internet control gateway +1 moreQi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control4.8 Medium
- tenda w15e firmwareAn incorrect access control vulnerability exists in Tenda W15E V02.03.01.26_cn. An...7.5 High
- bytedeskBytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload5.3 Medium
- bytedeskBytedesk SVG File UploadRestController.java uploadFile unrestricted upload5.3 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control2.3 Low
- tencent weknoraWeKnora: Broken Access Control - Cross-Tenant Data Exposure5.3 Medium
- tencent weknoraWeKnora: Broken Access Control in Tenant Management8.8 High
- chartbrewChartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations6.5 Medium
- ibexa ez platformIncorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x...7.5 High
- makeplane planePlane: Unauthenticated Workspace Member Information Disclosure7.5 High
- forceu gokapiGokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion5.4 Medium
- elated-themes frappeFrappe: Broken Access Control in DocShare7.1 High
- graphprotocol contracts, thegraph graph protocol contracts +1 moreThe Graph: Revocable vesting contracts allows early access to locked tokens5.3 Medium
- forceu gokapiGokapi: Privilege escalation with auth token5.0 Medium
- forceu gokapiGokapi: Data Leak in Upload Status Stream6.4 Medium
- openprojectOpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects4.3 Medium
- suse linux enterprise servernftables disabled due to incorrect kernel backport7.3 High
- tcs cognix platformMissing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon...7.5 High
- tcs cognix platformA broken access control vulnerability in the password reset functionality of Tata Consultancy...8.1 High
- opencode ussd gatewayOpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control...8.1 High
- filebrowserFile Browser: TUS Delete Endpoint Bypasses Delete Permission Check9.1 Critical
- google chromeInappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote...8.8 High
- google chromeInappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a...8.8 High
- Show moreLoading…