CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- oracle iassetsVulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal...9.9 Critical
- oracle financials common modulesVulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite ...7.7 High
- oracle financials common modulesVulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite ...8.5 High
- oracle e-business suite, oracle corporation internet procurement connector +1 moreVulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite ...9.1 Critical
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...7.4 High
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...9.9 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...8.1 High
- openreplayOpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding7.7 High
- espocrmEspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes4.3 Medium
- eupago gateway for woocommerce, unknown eupago gateway for woocommerce +1 moreEupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation8.6 High
- rocket.chatThe Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8...7.5 High
- acer nitrorsense v3NitroSense V3: Security Vulnerability Information8.5 High
- microsoft ufoMicrosoft UFO shared WebSocket handler state causes cross-client response hijacking6.3 Medium
- mcdope pam usbpam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local7.4 High
- tassos framework, advanced custom fields, convert forms +7 more +9 moreExtension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla9.3 Critical
- zte zxunipos nds-lteBroken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product9.1 Critical
- cloud foundry foundation bosh director, cloud foundry bosh +1 moreCompromised VM can make arbitrary blobstore deletes6.8 Medium
- frangoteam fuxaFUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection8.9 High
- No product listedJeecgBoot AiragModelController access control5.3 Medium
- apple macosA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS...5.5 Medium
- apple macosA logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26. An...5.5 Medium
- No product listedJeecgBoot add access control5.3 Medium
- No product listedJeecgBoot selectDepart LoginController.selectDepart access control6.9 Medium
- No product listedJeecgBoot SysUser userEdit user.getUsername access control5.3 Medium
- citeum openctiOpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd7.2 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260515] - Incorrect Access Control in sample data plugins5.3 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260516] - Incorrect Access Control in com_scheduler6.4 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260508] - Improper access check in com_config webservice endpoints8.6 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints8.2 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260513] - Privilege escalation through com_users batch task8.2 High
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control6.9 Medium
- e107inc e107e107: Broken Access Control in e107 comment edit allows cross-user comment modification6.5 Medium
@koa/routernpm@koa/router has an Access Control Bypass6.9 Medium- hemant6488 codeigniter-studentmanagementsystemhemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control6.9 Medium
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +26 more +28 moreSamba: missing access check on reparse point operations7.1 High
- sourcecodester simple pos and inventory systemSourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload5.3 Medium
- No product listedKLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload6.9 Medium
- acer nitrorsense v3NitroSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
- sourcecodester indian invoicing systemSourceCodester Indian Invoicing System Backend Endpoint access control5.3 Medium
- yangzongzhuan ruoyi-vueyangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure6.9 Medium
- calcom cal.diycalcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure6.9 Medium
- baptistearno typebot.ioTypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint7.1 High
- devolutions serverImproper access control in the entry activity log feature in Devolutions Server allows an...4.3 Medium
- devolutions serverMissing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier...4.3 Medium
- dell ecs, elastic cloud storage +1 moreDell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access...5.9 Medium
- ubiquiti unifi os, free5gc udm, udr +59 more +61 moreA malicious actor with access to the network could exploit an Improper Access Control...10.0 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplate6.3 Medium
- hulumi policies@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass9.3 Critical
- hulumi policies@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass8.7 High
- Show moreLoading…