CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- ubiquiti inc unifi talk applicationA malicious actor with access to the network and low privileges could exploit an Improper Access...8.1 High
- ubiquiti inc unifi network applicationA malicious actor with access to the network and low privileges could exploit an Improper Access...8.8 High
- ubiquiti inc unifi network applicationA malicious actor with access to the network,low privileges and under certain conditions could...8.3 High
- ubiquiti inc cloud gateways, dream machines, dream routers +5 more +7 moreA malicious actor with access to the network and under certain network configurations could...9.0 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +23 more +25 moreA malicious actor with access to the network and low privileges and under certain conditions...7.5 High
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA malicious actor with access to the network could exploit an Improper Access Control...8.6 High
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA malicious actor with access to the network could exploit an Improper Access Control...8.6 High
- ubiquiti inc unifi access application, ui unifi access +1 moreA malicious actor with access to the network and high privileges could exploit an Improper Access...9.1 Critical
- ubiquiti inc unifi connect applicationA malicious actor with access to the network could exploit an Improper Access Control...10.0 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreAuthorization Bypass in mlflow/mlflow8.1 High
- craftcms cmsCraft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check6.0 Medium
- patrickhener goshsgoshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags8.1 High
- google chromeInsufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47...6.5 Medium
- google chromeInsufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47...6.5 Medium
- google chromeInappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed...4.3 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an...4.3 Medium
- google chromeInsufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47...6.5 Medium
- google chromeInsufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed...6.5 Medium
- google chromeInappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInsufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47...6.5 Medium
- google chromeInsufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47...6.5 Medium
- google chromeInsufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a...5.3 Medium
- google chromeInappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47...6.5 Medium
- google chromeInappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed...6.5 Medium
- google chromeInappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed...5.5 Medium
- google chromeInsufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a...8.8 High
- google chromeInsufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an...8.1 High
- google chromeInappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47...7.8 High
- cap-go capgoCapgo - Missing UPDATE RLS Policy for Build Status Persistence5.3 Medium
github.com/fission/fissionGoFission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec8.1 High- nokia mantaray nmAn Improper Access Control vulnerability in Nokia MantaRay NM6.5 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2...7.1 High
- apple ipados, macos, safari +5 more +7 moreA permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26...6.5 Medium
- ollyo helix3, joomshaper.com helix3 extension for joomla +1 moreJoomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler7.5 High
- joomlack page builder, page builder ck, joomlack.fr page builder ck extension for joomla +2 moreJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.010.0 Critical
- code-projects inventory management systemSourceCodester Inventory Management System User Registration Endpoint users_handler.php access control6.9 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System controller.php add unrestricted upload6.9 Medium
- hanwang e-face general management platformHanwang e-Face General Management Platform upload.do unrestricted upload6.9 Medium
- feehi cmsFeehi CMS API users access control5.3 Medium
- No product listedA buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows...7.5 High
github.com/apernet/hysteria/coreGo,github.com/apernet/hysteria/core/v2Go +1 moreHysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF7.4 High- significant-gravitas autogptAutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering5.4 Medium
- revive adserver, revive-adserver revive adserver +1 moreA bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API...4.3 Medium
- revive adserver, revive-adserver revive adserver +1 moreA bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to...4.3 Medium
- Show moreLoading…