CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mervinpraison praisonaiPraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults8.8 High
- hydro-québec le circuit electrique charging station backendHydro-Québec Le Circuit Electrique charging station backend Improper Access Control9.3 Critical
- cap-go capgoCapgo - Channel Configuration Mutation via Write-Scoped API Keys7.1 High
- apache software foundation iotdbApache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users7.5 High
- apache software foundation iotdbApache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor6.5 Medium
- zhayujie cowagentzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure5.3 Medium
- sipeed picoclawSipeed PicoClaw Launcher access_control.go IPAllowlist access control6.9 Medium
- hoppscotchHoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server7.5 High
- manjurulhoque django-job-portalmanjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control5.3 Medium
@jsonbored/gittensory-mcpnpmGittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data6.5 Medium- No product listedUnauthorized use of Kyocera printers, allows all information stored in the Kyocera address book...7.5 High
- No product listedIncorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass...8.1 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability8.2 High
- cap-go capgoCapgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update5.3 Medium
- grafana oss, grafana, grafana enterprise +2 moreCross-Organization Public Dashboard Deletion via Missing Org Isolation3.1 Low
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints6.4 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints6.4 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260709] - Incorrect Access Control in com_workflow6.4 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260710] - Incorrect Access Control in com_modules6.4 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints6.4 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download6.4 Medium
- traefikTraefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port6.3 Medium
- scribanScriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor9.3 Critical
- apache iotdbApache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write9.8 Critical
- apache camelApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including de…9.8 Critical
- formbricksFormbricks Survey actions.ts access control6.9 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload5.3 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted upload5.3 Medium
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload5.3 Medium
- tubitak bilgem software technologies research institute pardus-parental-controlDNS Hijacking in TUBITAK BILGEM's Pardus-Parental-Control8.8 High
- ruijie rg-uacRuijie RG-UAC user_auth_commit.php unrestricted upload6.9 Medium
- sourcecodester syllabus-aligned learning management and examination systemSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload5.3 Medium
- microsoft edge chromium, edge (chromium-based) +1 moreMicrosoft Edge for Android Security Feature Bypass Vulnerability6.5 Medium
- gitea open source git serverImproper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts9.8 Critical
- gitea open source git serverUnauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability8.1 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability8.1 High
- gitea open source git serverGitea forwarded-proto handling allows public URL spoofing7.5 High
- gitea open source git serverGitea draft releases use insufficient permission checks7.5 High
- gitea open source git serverGitea LFS mirror synchronization bypasses migration HTTP transport restrictions9.8 Critical
- gitea open source git serverGitea OAuth2 PKCE S256 challenges are not enforced during token exchange9.1 Critical
- gitea open source git serverGitea organization permission APIs expose private visibility information7.5 High
- gitea open source git serverGitea pull-request branch updates use insufficient permission checks7.5 High
- gitea open source git serverGitea fork synchronization can expose private parent repository data7.5 High
- gitea open source git serverGitea tracked-time list endpoint has insufficient permission checks5.3 Medium
- gitea open source git serverGitea Docker image trusts spoofable reverse-proxy headers by default9.8 Critical
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource5.4 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 moreKeycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission4.3 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0...4.3 Medium
- microsoft azure synapseMicrosoft Azure Synapse Elevation of Privilege Vulnerability4.8 Medium
- Show moreLoading…