CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cisco iot field network director, iot field network director (iot-fnd) +1 moreCisco IoT Field Network Director Remote Device Denial of Service Vulnerability7.7 High
- flowiseai flowiseFlowiseAI Flowise Endpoint account.service.ts verify information disclosure6.3 Medium
- flowiseai flowiseFlowiseAI Flowise API Response account.service.ts login information disclosure6.3 Medium
- No product listedBitcoin Core through 28.x has a security issue, the details of which are not disclosed. The...7.5 High
- phpvmsphpvms: /importer authorization bypass causing full database wipe9.4 Critical
- openclawOpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header8.5 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover8.1 High
- apache polarisApache Polaris: No protection on `write.metadata.path`9.4 Critical
funadmin/funadminPackagistfunadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload6.9 Medium- code-projects bloodbank managing systemcode-projects BloodBank Managing System request_blood.php unrestricted upload5.3 Medium
rdiffwebPyPIIKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users8.1 HighmindsdbPyPIMindsDB Engine proc_wrapper.py exec unrestricted upload6.9 Medium- acrel electrical eems enterprise power operation and maintenance cloud platformAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload5.3 Medium
- eyeo adblock pluseyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control6.9 Medium
- No product listedcrmeb_java Admin Upload UploadServiceImpl.java unrestricted upload5.1 Medium
- No product listedMacCMS Pro Plugin Installation add.html install unrestricted upload5.1 Medium
- linuxfoundation automotive grade linuxAGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute...7.8 High
- ibm iIBM i is affected by a privilege escalation vulnerability in Web Administration GUI []6.4 Medium
- chartbrewChartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override6.5 Medium
- chartbrewChartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks7.5 High
- chartbrewChartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks8.1 High
- 1024-lab smart-admin1024-lab smart-admin Demo Site index.html access control6.9 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload5.1 Medium
- tubitak bilgem software technologies research institute pardus software centerImproper Access Control in TUBITAK BILGEM's Pardus Software Center8.8 High
- neorazorx facturascriptsFacturaScripts unauthorized modification of immutable nick field via EditUser controller5.3 Medium
- agilonhealth minervaMultiple vulnerabilities in MphRx's Minerva8.5 High
- agilonhealth minervaMultiple vulnerabilities in MphRx's Minerva9.4 Critical
- code-projects online music sitecode-projects Online Music Site AdminUpdateAlbum.php unrestricted upload5.1 Medium
- vmware spring aiVectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration5.9 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System edithousepic.php unrestricted upload5.1 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System activity.php unrestricted upload5.1 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel company unrestricted upload5.3 Medium
- No product listedGreenCMS index.php themeadd unrestricted upload5.3 Medium
- No product listedGreenCMS index.php pluginAddLocal unrestricted upload5.3 Medium
- 666ghj mirofish666ghj MiroFish Werkzeug Debugger PIN console information disclosure6.3 Medium
- smythos sreSmythOS sre Connector Service utils.ts information disclosure5.1 Medium
- avo-hq avoAvo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources8.8 High
- No product listedA Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low...6.5 Medium
- No product listedIn Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution...4.7 Medium
- rocket.chatIn versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the...4.3 Medium
- th30d4y openlearnxOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment8.8 High
- microsoft partner centerMicrosoft Partner Center Elevation of Privilege Vulnerability9.6 Critical
- actualbudget actualActual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers8.8 High
- openclawOpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions5.3 Medium
- siemvk openlearnOpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled6.9 Medium
- nocobaseNocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call7.2 High
- projectdiscovery nucleiNuclei: Local File Read via require() Module Loader Bypass5.5 Medium
- openremoteOpenRemote has Improper Access Control via updateUserRealmRoles function7.0 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization Rules7.5 High
- raindropInsufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5...6.5 Medium
- Show moreLoading…