CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...6.5 Medium
- google chromeInappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote...6.3 Medium
- google chromeInappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote...8.8 High
- google chromeInsufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an...6.5 Medium
- google chromeInappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- arista networks eosOn affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.6.9 Medium
- kurt software studio writeup mobile appImproper Access Control in Kurt Software Studio's WriteUp Mobile App8.8 High
- mjperpinosa stumasymjperpinosa stumasy change_profile_image.php unrestricted upload5.3 Medium
- mjperpinosa stumasymjperpinosa stumasy add_post.php unrestricted upload5.3 Medium
- No product listedA lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass...4.6 Medium
- No product listedIncorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0...9.8 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access Control...7.8 High
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access control...6.1 Medium
- aiven-open klawKlaw: Improper Access Control Allows Disclosure of Password Hash6.9 Medium
- devolutions serverImproper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and...5.4 Medium
- devolutions serverImproper access control in the permission validation component in Devolutions Server 2026.1.19...5.3 Medium
- progress sitefinityCWE-284: Improper Access Control in web services in Progress Sitefinity9.8 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreImproper Access Control in mlflow/mlflow6.5 Medium
- google androidIn many functions of ComputerEngine.java, there is a possible way to access URIs across users due...7.8 High
- ivanti neurons for itsm (cloud), neurons for itsm (on-premises) +1 moreAn Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises)...8.8 High
- j3k0 mcp-google-workspacej3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control5.3 Medium
- nextcloud user oidc, kiteworks security-advisories +1 moreNextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate4.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access6.5 Medium
- kiteworks security-advisoriesNextcloud: Unauthorized force-mute from missing permission check when using internal signaling3.5 Low
- kiteworks security-advisoriesNextcloud: Valid share tokens allow to access tempory upload files of share owner6.3 Medium
- kiteworks security-advisoriesNextcloud: Improper Access Control in Collectives2.6 Low
- kiteworks security-advisoriesNextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames4.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control6.9 Medium
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM upload.jsp unrestricted upload5.3 Medium
- mosaic5g flexricFlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the...7.5 High
- bdtask multi-store inventory management systemBdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload5.3 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java access control5.3 Medium
- mervinpraison praisonai-platformPraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership8.8 High
- mervinpraison praisonai-platformPraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID8.8 High
- mervinpraison praisonaiPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset9.8 Critical
- agenticmail @agenticmail/api, @agenticmail/core +1 moreAgenticMail API/storage and outbound relay hardening8.2 High
- @clerk nuxt, nuxt nuxt\/nitro-server +1 moreNuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`6.3 Medium
- rustfsRustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root9.3 Critical
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: MQTT Broker Access Control8.3 High
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...5.3 Medium
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions...10.0 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...9.9 Critical
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal...8.1 High
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service...8.8 High
- oracle universal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...9.9 Critical
- Show moreLoading…