CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- github github-mcp-serverGitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion6.0 Medium
- themeisle ppom for woocommerceWordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability6.5 Medium
- dell display and peripheral managerDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper...7.8 High
- nlnet labs nsdBypass of client certificate verification with transfer over TLS8.2 High
- fossbillingFOSSBilling: IDOR in Servicecustom Client API allows cross-client data access7.1 High
- cap-go capgoCapgo - Unsecured Supabase Images Bucket via Missing Row Level Security6.9 Medium
- cap-go capgoCapgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update7.1 High
- gogsGogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion7.1 High
- gogsIn Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a...7.1 High
- revive adserverAn access control bypass allows an advertiser‑level user to activate or deactivate a banner in...5.4 Medium
- revive adserverA missing access control check when invoking various modify methods in the XML‑RPC API of Revive...4.3 Medium
- revive adserverA missing access control check when linking trackers to campaigns through the campaign-trackers...4.3 Medium
- revive adserverA missing access control check when linking banners or campaigns to a zone through the zone...4.3 Medium
- hclsoftware connectionsHCL Connections is vulnerable to broken access control3.5 Low
- budibaseBudibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase7.3 High
- motioneye-project motioneyemotionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint6.5 Medium
- grafana snowflake, snowflake datasource +1 moreLocal File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT9.6 Critical
- cap-go capgoCapgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC8.7 High
- ezbsystems ultraiso premium editionEzbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control8.5 High
- im-magic partition resizerIM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control8.5 High
- easeus partition masterEaseUS Partition Master Kernel Driver EUEDKEPM.sys access control8.5 High
- easeus partition masterEaseUS Partition Master Kernel Driver epmntdrv.sys access control8.5 High
- aomei backupperAOMEI Backupper Kernel Driver amwrtdrv.sys access control8.5 High
- aomei dynamic disk managerAOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control8.5 High
- aomei partition assistantAOMEI Partition Assistant Kernel Driver ampa10.sys access control8.5 High
- joomshaper sp page builder, joomshaper.net sp page builder extension for joomla +1 moreJoomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.210.0 Critical
- icagenda, icagenda.com icagenda extension for joomla +1 moreJoomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.1510.0 Critical
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC8.7 High
- flexera flexnet manager suiteFlexNet Manager Suite Attachment File Disclosure7.1 High
- flexera flexnet manager suiteFlexNet Manager Suite Privilege Escalation Vulnerability8.7 High
- dell server hardware managerDell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control...7.8 High
- microsoft dynamics 365Dynamics 365 Elevation of Privilege Vulnerability9.9 Critical
- conda-forge conda-smithyconda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository7.6 High
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`...1.8 Low
- zitadelZITADEL: Cross-Tenant User Leakage via Recycled Identifiers2.3 Low
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics Student Self-Registration Endpoint index.php access control6.9 Medium
- gitea open source git serverGitea organization forks can expose organization secrets without create permission8.1 High
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...7.1 High
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...5.7 Medium
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion6.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletion7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged chat-file link allows cross-user file read and deletion8.3 High
- traefikTraefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services6.0 Medium
- google chromeInsufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155...4.2 Medium
- No product listedIn Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of...8.8 High
- gitea open source git serverGitea repository archive downloads bypass token scope checks9.1 Critical
- gitea open source git serverGitea Basic Auth bypasses OAuth2 access token scopes8.1 High
- n8nn8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints8.9 High
- rocket.chatRocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access...9.3 Critical
- Show moreLoading…