CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- secureage catchpulseImproper access control check in CatchPulse's named pipe communication interface5.2 Medium
- secureage catchpulseImproper access control vulnerability in CatchPulse8.4 High
- unknown seo redirection pluginSEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure5.4 Medium
- unknown checkimate — woocommerce checkout, abandoned cart recovery & order bumpsCheckimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret8.2 High
- netease-youdao lobsterainetease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Memory Toolset model_tools.py access control5.3 Medium
- heshengtao super-agent-partyheshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosure6.9 Medium
- No product listedInsecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate...8.8 High
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload6.9 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement5.9 Medium
- electronElectron: Sandboxed iframes can launch external protocol handlers5.4 Medium
- jenkinsJenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that...2.7 Low
- cyber-iii student-management-systemimranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload5.3 Medium
- cisco catalyst sd-wan controller, catalyst sd-wan manager +1 moreCisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities9.9 Critical
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Security Hardening Release9.0 Critical
- electronElectron: Extension tab APIs operate across session boundaries6.6 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 moreKeycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers8.1 High
- dgtlmoon changedetection.iochangedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement6.3 Medium
- unknown yaypricingYayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure8.1 High
- unknown user registration & membershipUser Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled7.5 High
- No product listedZosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains...7.5 High
- No product listedSirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated...8.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Any member with write access to a standard channel can edit or delete other members' messages5.4 Medium
- flowiseai flowiseFlowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation8.3 High
- trippo responsivefilemanagerTrippo ResponsiveFilemanager dialog.php unrestricted upload6.9 Medium
- unknown rest api logREST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint5.9 Medium
- creative motion clearfy cacheClearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher4.3 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout5.4 Medium
- unknown the gdpr framework by data443The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam6.5 Medium
- tomdever wpforo forumwpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment4.3 Medium
- No product listedIncorrect access control in the Executive Services dynamic application start path component of...9.1 Critical
- dell display and peripheral manager (ddpm mac), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper...7.8 High
- wellbia xigncode3CVE-2026-154306.2 Medium
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).3.7 Low
- kodezen llc academy lmsAcademy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint6.5 Medium
- No product listedIncorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index...7.5 High
- No product listedIncorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers...7.5 High
- unknown clever mega menu for visual composerClever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item4.3 Medium
- unknown ai chatbot for woocommerceChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response7.5 High
- rustaurius five star restaurant reservationsFive Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications7.5 High
- theeventscalendar event tickets and registrationEvent Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation5.3 Medium
- unknown pixel tag manager for woocommercePixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission6.5 Medium
- unknown buckaroo woocommerce payments pluginWC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund6.5 Medium
- unknown builderall for wordpressBuilderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes3.7 Low
- unknown direct payments for woocommerceDirect Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions5.3 Medium
- andritz 250 scala, hipase-250 +1 moreMissing authentication for logging-configuration endpoint5.3 Medium
- unknown mailgun for wordpressMailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX6.5 Medium
- nodejs nodeA flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites)...3.3 Low
- No product listedAn issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows...9.8 Critical
- clastix kamajiKamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation8.5 High
- Show moreLoading…