CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedTotara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can...9.8 Critical
- fastgptBroken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT5.3 Medium
- code-projects online library management systemcode-projects Online Library Management System SQL Database Backup File library.sql information disclosure5.3 Medium
- bmc control-m\/managed file transferAn issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint...7.5 High
- code-projects patient record management systemcode-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosure5.3 Medium
- code-projects movie ticketing systemcode-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosure5.3 Medium
- google chromePolicy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote...8.8 High
- zammadZammad has incorrect access control in getting_started_controller8.7 High
- zammadZammad has an information disclosure in ticket detail view of customers in shared organizations2.1 Low
- linuxfoundation podman desktop, podman-desktop, red hat build of podman desktop +2 more +4 morePodman Desktop WebView Server Exposed8.2 High
- jdx misemise has a local settings bypass config trust checks7.8 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 moreVite has a `server.fs.deny` bypass with queries8.2 High
- orangehrmOrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding5.3 Medium
- openclawOpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge2.1 Low
- churchcrm, churchcrm crm +1 moreChurchCRM has an API Authentication Bypass9.1 Critical
- pegasystems pega browser extension (pbe)A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.6.0 Medium
- pegasystems pega robot studioAn arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Ed…7.2 High
- lollms, parisneo parisneo/lollms +1 moreImproper Access Control via Weak JWT Token in parisneo/lollms9.8 Critical
- mrcmsMRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org...9.8 Critical
- genieacsGenieACS has an unauthenticated access vulnerability via the NBI API endpoint7.5 High
- haxtheweb haxiamHAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses8.7 High
- distribution, red hat multicluster engine for kubernetes, advanced cluster management for kubernetes 2 +7 more +9 moreDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation7.5 High
- cyber-iii student-management-systemCyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload5.3 Medium
- scoder lupa, red hat openshift ai (rhoai), satellite 6.18 +2 moreLupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr7.9 High
- kaleris yard management solutionsIncorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the...4.3 Medium
- acrel electrical prepaid cloud platformAcrel Electrical Prepaid Cloud Platform Backup File bin.rar information disclosure6.9 Medium
- tencent ai-infra-guardTencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure6.9 Medium
- jkev record management systemSourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload5.1 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 fs unrestricted upload6.9 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure6.9 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 Endpoint access control6.9 Medium
- campcodes complete online learning management systemCampcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted upload5.3 Medium
- tenda 4g03 pro, 4g03 pro firmware +1 moreTenda 4G03 Pro httpd access control6.9 Medium
- directusDirectus has a Path Traversal and Broken Access Control in File Management API8.5 High
- fortinet forticlientems, forticlient ems +1 moreA improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow...9.1 Critical
- belden hirschmann hilcos bat867, hirschmann hilcos openbat, bat450, wlc +1 moreHirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass5.3 Medium
- belden hirschmann hilcos openbatHirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass9.3 Critical
- bookstackapp bookstackBookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control6.9 Medium
- projectsandprograms school management systemProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload5.3 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.1 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.5 High
- newgen omnidocsNewgen OmniDocs GetWebApiConfiguration information disclosure6.3 Medium
- signalk signal k server, signalk-server +1 moresignalk-server: Unauthenticated Source Priorities Manipulation6.9 Medium
- progress sharefile storage zones controllerEAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)9.8 Critical
- mayuri k best courier management systemSourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control6.9 Medium
- ci4-cms-erp ci4msCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)8.8 High
- ci4-cms-erp ci4msCI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)8.8 High
- d-link dnr-202l, dnr-322l, dnr-326 +37 more +39 moreD-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control6.9 Medium
- Show moreLoading…