CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- argoproj argo workflows, argo-workflows +1 moreArgo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing8.9 High
- bigbluebuttonBigBlueButton API checksum bypass via presentationUploadExternalUrl8.1 High
- spaceapplications yamcsYamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets4.3 Medium
- hcl software dfxserver, hcltech dfx server +1 moreHCL DFXServer is affected by a Missing Access Control vulnerability6.3 Medium
- keycloak, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users8.1 High
- sandboxie-plus sandboxieSandboxie-Plus: Sandboxie APC Injection Sandbox Escape7.7 High
- axiomthemes anubisAnubis: Policy bypass via client controlled X-Original-URI header5.8 Medium
- wekanWekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)8.5 High
- lissy93 dashyDash: Users can write to config despire permissions (OIDC tested)8.2 High
- pegatron corp. tdelo64.sysCVE-2026-149609.8 Critical
- cisco roomos, roomos software, roomos cloud +2 moreCisco RoomOS Security Hardening Release - Access Control Vulnerabilities8.8 High
- dani-garcia vaultwardenVaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity7.7 High
- imagemagickImageMagick before 7.1.2-26 Policy Bypass via script operation4.8 Medium
- julien040 anyqueryAnyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode7.5 High
- julien040 anyqueryAnyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode8.6 High
- microsoft configuration manager, configuration manager 2503, configuration manager 2509 +1 more +3 moreConfiguration Manager Elevation of Privilege Vulnerability8.8 High
- julien040 anyqueryAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode9.1 Critical
- microsoft 365 copilot, 365 copilot for ios +1 moreM365 Copilot for iOS Elevation of Privilege Vulnerability8.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Kernel Security Feature Bypass Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) +4 more +6 moreExtensible Storage Engine (ESENT) Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability5.4 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreDNS Client Tampering Vulnerability6.1 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows DNS Client Tampering Vulnerability7.1 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +10 more +12 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +6 more +8 moreWindows System Secure Feature Bypass Vulnerability5.1 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Search Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Operating Systems Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWin32k Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWin32k Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +3 more +5 moreWindows MIDI Service Module Elevation of Privileges Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWin32k Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Server Elevation of Privilege Vulnerability7.8 High
- microsoft remote help, windows remote help +1 moreWindows Remote Help Defense Elevation of Privilege Vulnerability7.8 High
- code-projects online job portalcode-projects Online Job Portal JobSeekerInsert.php unrestricted upload6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw tool.go handleNavigate information disclosure5.3 Medium
- No product listedIncorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts...6.5 Medium
- cockpit cmsCockpit CMS Missing Authorization in Bucket File Storage API8.7 High
- openclawOpenClaw < 2026.6.6 Policy Bypass via CDP Discovery6.3 Medium
diracPyPIDIRAC: SQL injection and lack of access control in PilotManager service8.5 High- decidimDecidim: Private exports can be downloaded through reusable links6.5 Medium
- decidimDecidim: Forms admin question editor lacks authorization5.4 Medium
- sourcecodester online book store systemSourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload5.1 Medium
- No product listedWuzhiCMS Attachment API index.php listimage information disclosure6.9 Medium
- area 17 twill cmsAREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload5.1 Medium
- opener project openerEIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control...9.1 Critical
- hcr707305003 shiroiadminhcr707305003 shiroiAdmin FileController.php upload unrestricted upload6.9 Medium
- qiling disk masterQILING Disk Master Kernel Driver diskbckp.sys access control4.8 Medium
- minitool partition wizardMiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control4.8 Medium
- imagemagickImageMagick before 7.1.2-26 Memory Allocation Policy Bypass4.8 Medium
- Show moreLoading…