CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- fissionFission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger9.8 Critical
- bytecodealliance wasmtimeWasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction7.5 High
- powerdns authoritativeIncorrect Behaviour of Views with TCP PROXY Requests4.8 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreAuthorization Bypass in SearchModelVersions in mlflow/mlflow6.5 Medium
- triliumnext triliumTrilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds8.6 High
- mesalvo meona client, meona server +1 moreImproper Access Control vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona...7.8 High
- No product listedInfoScale CmdServer before 7.4.2 mishandles access control.8.8 High
- convoypanel panelCtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass8.1 High
- convoypanel panelCtrlPanel: Unauthenticated RCE using installer script10.0 Critical
- convoypanel panelCtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints6.5 Medium
- jasonlovesdoggo caddy-defenderCaddy Defender trusted proxy client IP bypass8.2 High
- wwbn avideoWWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`6.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass6.5 Medium
- apache ofbizApache OFBiz: Cross-Tenant Data Exposure via Program Export Feature5.3 Medium
- rocket.chatThe /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, ...5.3 Medium
- No product listedAn authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an...7.3 High
- czlonkowski n8n-mcpn8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete8.1 High
sulu/suluPackagistSulu: Used API Keys may be available via Admin API2.3 Low- No product listedIncorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows...9.1 Critical
- kilo-org kilocode, kilo code cli +1 moreKilo-Org kilocode Environment Variable config.ts load information disclosure5.3 Medium
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM upload3.jsp unrestricted upload6.9 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control6.9 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure6.9 Medium
- boxlite-ai boxliteBoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files10.0 Critical
- amd instinct™ mi300a, instinct™ mi300x, instinct™ mi308x +3 more +5 moreImproper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine ...8.8 High
- amd ryzen™ 7040 series mobile processors with radeon™ graphics, ryzen™ 8000 series desktop processors, ryzen™ 8040 series mobile processors with radeon™ graphics +1 more +3 moreImproper access control between the Joint Test Action Group (JTAG) and Advanced Extensible...5.3 Medium
- rapid7 metasploit proMetasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading8.5 High
- No product listedMedical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure...6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file8.1 High
- google chromeInappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a...5.5 Medium
- google chromeInsufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168...4.3 Medium
- google chromeInappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed...3.1 Low
- google chromeObject corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote...3.1 Low
- wger-project wgerwger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API7.5 High
- flowiseai flowiseFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- northern.tech cfengineNorthern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.5.3 Medium
- hoppscotchhoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token7.5 High
- grafana, grafana oss +1 moreIDOR in Annotations API allows unprivileged users to DELETE annotation4.3 Medium
- grafana oss, grafana +1 moreUsers can generate Service Account tokens after permissions removal5.9 Medium
- grafana, grafana oss +1 moreDashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin7.1 High
- obot-platform obotobot before v0.21.1 Authorization Bypass via /mcp-connect9.3 Critical
- traefik, red hat openshift dev spaces 3.29, openshift gitops +2 moreTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false6.4 Medium
- u-speed t18-21k firmwareU-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access...6.8 Medium
- reconurge flowsintFlowsint: Broken Access Control allows modification of investigation metadata from any user2.3 Low
- reconurge flowsintFlowsint: Broken Access Control allows reading of sketch logs from any user5.3 Medium
- karnop gojobsGoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint5.3 Medium
- enesgkky pulpyPulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files9.3 Critical
- Show moreLoading…