CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- convoypanel panel, reviactyl +1 moreReviactyl: OAuth account takeover via auto-linking9.1 Critical
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control6.9 Medium
- harvard university iqss dataverseHarvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload5.3 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260301] - ACL hardening in com_ajax6.3 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260306] - Improper access check in webservice endpoints8.6 High
- shandong hoteam inforcenter plmShandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload6.9 Medium
- foxit esign, foxit software inc. na1.foxitesign.foxit.com +1 moreInsecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign7.1 High
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command8.4 High
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter5.3 Medium
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control5.3 Medium
- wwbn avideoAVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard6.5 Medium
- admidioAdmidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess7.5 High
- discourseDiscourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure5.1 Medium
- sourcecodester simple doctors appointment systemSourceCodester Simple Doctors Appointment System ajax.php unrestricted upload5.3 Medium
- openclawOpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint5.3 Medium
- osrg gobgposrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control6.3 Medium
- osrg gobgposrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control6.3 Medium
- frrouting frr, frrouting +1 moreFRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control2.3 Low
- theunwindai awesome llm appsA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in...8.2 High
- No product listedIncorrect access control in the file_details.asp endpoint of DDSN Interactive Acora CMS v10.7.1...6.5 Medium
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...5.3 Medium
- promtengineer localgptPromtEngineer localGPT Web api_server.py handle_index information disclosure6.9 Medium
- promtengineer localgptPromtEngineer localGPT server.py do_POST unrestricted upload6.9 Medium
- danny-avila librechatLibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats5.3 Medium
- franklioxygen mytubeMyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration8.9 High
- anjoy8 blog.admin, blog.core +1 moreA blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access...4.3 Medium
- No product listedBS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. An unauthenticated...6.5 Medium
- internationalization project internationalization, drupal internationalization (i18n) - i18n node submodule +1 moreAccess bypass in Drupal 7 i18n_node translation UI5.3 Medium
- ciliumCilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic5.4 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Missing Functional Level Access Control8.1 High
- itsourcecode free hotel reservation systemitsourcecode Free Hotel Reservation System index.php unrestricted upload5.1 Medium
- kalcaddle kodboxkalcaddle kodbox Public Share userShare.class.php add privilege escalation6.3 Medium
- enter software iperius backupEnter Software Iperius Backup NTLM2 information disclosure2.0 Low
@grackle-ai/mcpnpm@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool8.6 High- apple ipados, macos, visionos +2 more +4 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4...6.2 Medium
- apple ipados, ios and ipados, iphone os +2 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.7...6.8 Medium
- apple macosA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS...5.3 Medium
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.3 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.3 Medium
- apple macosA privacy issue was addressed with improved private data redaction for log entries. This issue is...5.3 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.3 Medium
- apple macosA path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe...4.9 Medium
- apple macosA logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia...5.3 Medium
- apple ipados, tvos, visionos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4...6.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.3...7.5 High
- apple macosA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in...5.3 Medium
- apple macosA privacy issue was addressed with improved handling of temporary files. This issue is fixed in...7.5 High
- apple ipados, macos, visionos +2 more +4 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7...6.5 Medium
- apple ipados, visionos, watchos +2 more +4 moreThe issue was addressed with improved authentication. This issue is fixed in iOS 26.4 and iPadOS...4.6 Medium
- apple ipados, ios and ipados, iphone os +2 moreThe issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An...4.6 Medium
- Show moreLoading…