CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- arubanetworks arubaos, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +1 moreAuthenticated Arbitrary File Download via AOS-10 Web-Based Management Interface4.9 Medium
- apple macos, macos sequoia, macos sonoma +1 more +3 moreAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...8.8 High
- siemens linux-entra-ssolinux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted5.3 Medium
- microsoft office, excel, excel for android +5 more +7 moreMicrosoft Office Spoofing Vulnerability7.7 High
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure connected machine agentAzure Connected Machine Agent Elevation of Privilege Vulnerability7.8 High
- microsoft windows admin center in azure portal, windows admin center +1 moreWindows Admin Center in Azure Portal Elevation of Privilege Vulnerability8.8 High
- microsoft office, 365 apps, 365 apps for enterprise +4 more +6 moreMicrosoft Office Click-To-Run Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Filtering Platform (WFP) Security Feature Bypass Vulnerability4.4 Medium
- microsoft 365 copilot, m365 copilot for desktop +1 moreM365 Copilot for Desktop Spoofing Vulnerability6.2 Medium
- microsoft powerpoint for android, powerpoint +1 moreMicrosoft PowerPoint for Android Spoofing Vulnerability7.1 High
- microsoft word for android, word +1 moreMicrosoft Word for Android Spoofing Vulnerability7.1 High
- microsoft 365 copilot, 365 copilot for android, excel for android +4 more +6 moreMicrosoft 365 Copilot for Android Spoofing Vulnerability4.4 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Event Logging Service Elevation of Privilege Vulnerability7.8 High
- fortinet fortiauthenticatorA improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator...9.1 Critical
- intel visionImproper access control for some Intel Vision software for all versions within Ring 3: User...8.8 High
- zulip, zulip server +1 moreZulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history6.0 Medium
- gitlawb openclaudeOpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input9.3 Critical
- dovecot, open-xchange gmbh ox dovecot pro +1 moreAttacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl...3.1 Low
- apple ipados, visionos, ios and ipados +1 more +3 moreAn issue with app access to camera metadata was addressed with improved logic. This issue is...3.3 Low
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.5 High
- apple ipados, macos, visionos +2 more +4 moreThis issue was addressed by adding an additional prompt for user consent. This issue is fixed in...5.5 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.5 High
- apple ipados, macos, visionos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5...5.5 Medium
- apple macosThis issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe...3.3 Low
- apple ipados, ios and ipados, iphone os +2 moreA privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26...7.5 High
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved checks to prevent unauthorized actions. This issue is...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...8.8 High
- apple macosThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia...6.5 Medium
- mantisbtMantisBT allows unauthorized users to upload attachments to restricted issues via REST API4.3 Medium
- mantisbtMantisBT: Privilege Escalation from Manager to Administrator5.1 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode9.4 Critical
- wso2 identity server, conditional authentication user and roles related functions +1 moreAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover6.4 Medium
- dotouch xproupfDotouch XproUPF access control2.1 Low
- hikvision hikcentral professionalThere is an Access Control Vulnerability in some HikCentral Professional versions. This could...6.8 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: responses passthrough endpoint lacks access control authorization7.1 High
- langfuseLangfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys5.3 Medium
- acer predatorsense, predatorsense v3, nitrosense +2 morePredatorSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
- opnsense coreUltraDAG: Smart Account Spending Policy Bypass via Pockets8.8 High
- elunez eladmineladmin Users API Endpoint UserController.java checkLevel access control5.3 Medium
- pfsenseNetgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the...9.9 Critical
- microsoft azure ai foundryAzure AI Foundry Elevation of Privilege Vulnerability8.6 High
- microsoft azure managed instance for apache cassandraAzure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability9.9 Critical
- ivanti endpoint manager mobileAn Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows...7.0 High
- ivanti endpoint manager mobileAn Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and...8.8 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution9.1 Critical
- snipeitapp snipe-itSnipe-IT has insecure permissions in file uploads9.8 Critical
- picotronica e-clinic healthcare system echsPicoTronica e-Clinic Healthcare System ECHS Response Header v2 information disclosure6.9 Medium
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a...3.1 Low
- Show moreLoading…