CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- oracle life sciences empirica signalVulnerability in the Oracle Life Sciences Empirica Signal product of Oracle Life Science...8.5 High
- frappe hr, hrms +1 moreFrappe HR has Improper Access Control on Files6.5 Medium
- frappe hr, hrms +1 moreFrappe HR vulnerable to Improper Access Control6.5 Medium
- mailcow mailcow-dockerizedmailcow: dockerized missing authorization on Forwarding Hosts delete action6.0 Medium
- horilla-opensource horillaHorilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation7.1 High
- horilla-opensource horillaHorilla: Unauthorized Document Overwrite via File Upload Endpoint8.6 High
- horilla-opensource horillaHorilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>7.1 High
- freescout-help-desk freescoutFreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration9.0 Critical
- freescoutFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron8.9 High
- nodejs node, node.js +1 moreA flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket...3.3 Low
- nodejs node, node.js +1 moreA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent...5.6 Medium
- nodejs node, node.js +1 moreA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context...4.2 Medium
- m1k1o nekoNeko has Self-service Privilege Escalation for Authenticated Users8.8 High
- dolibarr erp\/crmDolibarr Allows Code Injection through its Website Module8.8 High
- textpatternTextpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management...6.5 Medium
- No product listedXiangShan (open-source high-performance RISC-V processor) commit...5.3 Medium
- gitlawb openclaudeOpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal8.4 High
- difyDify has IDOR in deleting someone else's chat conversation5.3 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI: Disabled users retain full API access through previously issued bearer tokens8.6 High
- No product listedZ-BlogPHP ZBA File app_upload.php UnPack unrestricted upload5.1 Medium
- rickxy hospital management systemrickxy Hospital Management System his_admin_account.php unrestricted upload6.9 Medium
- langflow-ai langflowlangflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload6.9 Medium
- No product listedEyouCMS Index.php edit_adminlogo unrestricted upload5.1 Medium
- daprDapr: Service Invocation path traversal ACL bypass8.1 High
- openclawOpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding9.0 Critical
- flowiseai flowiseFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)7.6 High
- neo4j-contrib mcp-neo4jmcp-neo4j-cypher: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures2.3 Low
- arnobt78 hotel booking management systemarnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure6.9 Medium
- querymine smsQueryMine sms Background Management addteacher.php unrestricted upload5.3 Medium
paperclipainpmPaperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email8.7 High- flowiseai flowise, flowise-components +1 moreFlowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox7.1 High
- netfoundry zrokzrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records5.3 Medium
- goodoneuz pay-uzgoodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution10.0 Critical
- wgerwger has Broken Access Control in the Global Gym Configuration Update Endpoint7.6 High
- No product listedAn issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar...6.5 Medium
- google chromeInsufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote...3.1 Low
- google chromeInsufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a...3.1 Low
- weblateWeblate: Improper access control for pending tasks in API3.1 Low
- splunk, splunk cloud platform, enterprise +2 moreImproper Access Control in Data Model Acceleration in Splunk Enterprise4.3 Medium
- No product listedIncorrect access control in the config.php component of Slah v1.5.0 and below allows...7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreUniversal Plug and Play (upnp.dll) Information Disclosure Vulnerability5.5 Medium
- microsoft dynamics 365, dynamics 365 (on-premises) version 9.0 +1 moreMicrosoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreMicrosoft Management Console Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreUEFI Secure Boot Security Feature Bypass Vulnerability4.4 Medium
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +10 more +12 moreRemote Access Management service/API (RPC server) Elevation of Privilege Vulnerability7.8 High
- octobercms octoberOctober CMS: Twig Sandbox Bypass via Collection Methods4.9 Medium
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreAn Improper Access Control vulnerability could allow a malicious actor with access to the UniFi...7.5 High
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreAn Improper Access Control vulnerability could allow a malicious actor with access to the UniFi...9.8 Critical
- codeastro online job portalCodeAstro Online Job Portal Delete Job Posting job-delete.php access control5.3 Medium
- huawei harmonyosAccess control vulnerability in the memo module. Impact: Successful exploitation of this...4.1 Medium
- Show moreLoading…