CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, visionos +2 more +4 moreA parsing issue in the handling of directory paths was addressed with improved path validation....7.5 High
- apple macosA validation issue existed in the entitlement verification. This issue was addressed with...8.4 High
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...3.3 Low
- pinchtabA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution6.1 Medium
- opensource-workshop connect-cmsConnect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature7.5 High
- pegasystems pega robot studioAn arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25.9.0 Critical
- codephiliax chat2dbCodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload5.3 Medium
- red hat build of keycloak, build of keycloak 26.4.12, jboss enterprise application platform 8 +2 more +4 moreKeycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control4.3 Medium
- acrel environmental monitoring cloud platformAcrel Environmental Monitoring Cloud Platform unrestricted upload6.9 Medium
- No product listedPbootCMS Backend UserController.php access control5.3 Medium
- langflowLangflow has Unauthenticated IDOR on Image Downloads7.5 High
- wwbn avideoAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection10.0 Critical
- eosphoros-ai db-gpteosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload5.3 Medium
- go-vikunja vikunjaVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement8.1 High
- discourseDiscourse fixes loose hostname matching in spam host allowlist4.3 Medium
- freescoutFreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages0.0 None
- langflowLangflow has an Arbitrary File Write (RCE) via v2 API10.0 Critical
- free5gc, free5gc nrf +1 morefree5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter8.7 High
- filebrowserFile Browser has an Authorization Policy Bypass in its Public Share Download Flow6.5 Medium
- canonical jujuUnauthorized access to Kubernetes secrets in Juju8.8 High
- danny-avila librechatLibreChat RAG API Authentication Bypass8.0 High
- oracle corporation edge cloud infrastructure designer and visualisation toolkit, oracle okit +1 moreVulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product...9.8 Critical
- cloudnativelabs kube-routerKube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS7.1 High
- b3log siyuanSiYuan has an Arbitrary File Read in its Desktop Publish Service9.9 Critical
- No product listedAn issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. It allows...8.1 High
- ctfer fullchainFullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.1 High
- ctfer-io romeoRomeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.9 High
- ctfer-io chall-managerChall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace7.9 High
- filebrowserFile Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin10.0 Critical
- educativa campusMultiple vulnerabilities on the Educativa Campus6.9 Medium
- educativa campusMultiple vulnerabilities on the Educativa Campus8.7 High
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload6.9 Medium
- technologies integrated management platformTechnologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload6.9 Medium
- No product listedmyAEDES App aedes.me.beta EngageBayUtils.java information disclosure2.0 Low
- glowxq glowxq-ojglowxq glowxq-oj SysFileController.java upload unrestricted upload6.9 Medium
- No product listedAn Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8....5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control6.9 Medium
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G goahead UpdateClientInfo access control6.9 Medium
- jawherkl node-api-postgresJawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload6.9 Medium
- d-link dir-816, dlink dir-816 firmware +1 moreD-Link DIR-816 goahead redirect.asp access control6.9 Medium
- ctfer-io monitoringImproper Access Control in github.com/ctfer-io/monitoring7.1 High
- ibm cics transaction gateway for multiplatforms, cics transaction gateway +1 moreIBM CICS Transaction Gateway for Multiplatforms Information Disclosure5.1 Medium
- openclawOpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +4 more +6 moreSystemd: systemd: privilege escalation via improper access control in registermachine d-bus method6.7 Medium
- stalin-143 websiteNEXULEAN API Key Leak8.2 High
- veeam backup and replication, backup \& replication +1 moreA vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on...10.0 Critical
- veeam backup and replication, backup \& replication +1 moreA vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on...10.0 Critical
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a...5.3 Medium
- google chromeInsufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote...5.3 Medium
- Show moreLoading…