CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- oracle webcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware ...9.9 Critical
- oracle webcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware ...9.9 Critical
- oracle webcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware ...9.9 Critical
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared...7.5 High
- oracle peoplesoft enterprise pt peopletoolsVulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component...8.7 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...9.1 Critical
- opentext identity managerVulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST...7.5 High
- opentext identity managerVulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). ...9.9 Critical
- oracle weblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). ...9.9 Critical
- oracle data integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component:...8.3 High
- denoDeno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks6.5 Medium
- n8nn8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint5.3 Medium
- devolutions serverImproper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1...4.3 Medium
- openclawOpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks7.6 High
- openclawOpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device Session8.7 High
- mia technology inc. pizzy libraryImproper Access Control in Mia Technologies' Pizzy Library7.1 High
- hcengineering huly platformhcengineering Huly Platform RPC operations.ts getMailboxSecret access control5.3 Medium
- hkuds ai-traderHKUDS AI-Trader Research Export agents.csv information disclosure6.9 Medium
- No product listedIncorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy...6.5 Medium
github.com/mickael-kerjean/filestashGo,govulncheck-vulndbopenSUSE +1 moreFilestash allows attackers to escalate privileges via sending a crafted request8.1 Highgrumpydictator/firefly-iiiPackagistProject Firefly III has incorrect access control in the webhook management component9.1 Critical- No product listedIncorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow...7.5 High
github.com/statping-ng/statping-ngGo,govulncheck-vulndbopenSUSE +1 morestatping-ng allows attackers to escalate privileges to Administrator and access sensitive components8.8 High- No product listedIncorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor...8.1 High
- No product listedIncorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows...8.1 High
org.snmp4j:snmp4j-agentMavenSNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component9.8 Critical- No product listedAn issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to...6.8 Medium
- openclawOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration7.4 High
- openclawOpenClaw < 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin Allowlist7.6 High
- openclawOpenClaw < 2026.5.18 - Command Truncation in Exec Approval Display8.5 High
- openclawOpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution8.7 High
- openclawOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn6.9 Medium
- nezhahq nezhaNezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing6.5 Medium
- discourseDiscourse: Replying to a whisper lets non-whisperers create staff-only whisper posts5.4 Medium
- elated-themes frappeFrappe: Broken Access Control on Private Files5.3 Medium
- elated-themes frappeFrappe: IDOR in update_onboarding_step5.3 Medium
- elated-themes frappeFrappe: IDOR in `submit_discussion()`6.9 Medium
- free5gc udm, udr, ubiquiti inc efg +12 more +14 moreUnder certain network configurations, a malicious actor with access to network could exploit an...8.1 High
- phpbbImproper verification of access permissions when modifying permissions through the Administration...7.2 High
- openclawOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing8.7 High
- openclawOpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node8.6 High
- openclawOpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority8.7 High
- openclawOpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions4.9 Medium
- openclawOpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension Metadata7.7 High
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...5.5 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.3 Medium
- cyberark software, a palo alto networks company conjur cloud (edge finding only), paloaltonetworks idira secrets manager edge +1 moreIdira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanism9.1 Critical
- paloaltonetworks idira secrets manager, cyberark software, a palo alto networks company conjur enterprise, paloaltonetworks idira secrets manager credential providers +2 moreIdira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints8.4 High
- Show moreLoading…