CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown wp crowdfundingWP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization4.3 Medium
- arraytics eventinEventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint8.2 High
- coturncoturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE5.8 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 22h2, windows 11 version 24h2, windows 11 version 25h2 +5 more +7 moreMicrosoft Windows Cross Device Service Elevation of Privilege Vulnerability7.8 High
- microsoft visual studio code copilot chat extension, github copilot chat +1 moreCoPilot Chat Security Feature Bypass Vulnerability7.1 High
- intel xeon 6315p firmware, xeon 6325p firmware, xeon 6333p firmware +172 more +174 moreImproper access control in the firmware for some in Alias Checking Trusted Module for some Intel...8.5 High
- intel proset\/wireless wifiImproper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2...8.4 High
- intel corporation intel(r) proset/wireless wifi software, intel proset\/wireless wifi +1 moreImproper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device...8.3 High
- intel xeon 6315p firmware, xeon 6325p firmware, xeon 6333p firmware +87 more +89 moreImproper access control for some Intel(R) Processors within Ring 3: User Applications may allow...7.2 High
- csz cms cms, cszcms csz cms +1 moreCSZ CMS CSZ CMS - Broken Access Control7.5 High
- idurar erp crmIdurar IDURAR ERP CRM - Broken Access Control7.5 High
- ghost foundation ghostGhost Foundation Ghost - Broken Access Control8.1 High
- badchoice handeskBadChoice Handesk - Broken Access Control8.1 High
- badchoice handeskBadChoice Handesk - Broken Access Control8.1 High
- peppermint lab peppermintPeppermint Lab Peppermint - Broken Access Control8.8 High
- peppermint lab peppermintPeppermint Lab Peppermint - Broken Access Control8.1 High
- ladybird web solution faveo helpdeskLadybird Web Solution Faveo Helpdesk - Broken Access Control6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreKbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login7.8 High
- frappe erpnextERPNext: Broken Access Control on certain endpoints7.1 High
- red hat openshift ai 3.3, openshift ai 3.4, openshift ai 3.5 +2 moreOdh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole8.8 High
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreRhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)8.8 High
- daptindaptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects9.1 Critical
- samsung smartthingsImproper access control in SmartThings prior to version 1.8.47.24 allows local attackers to...6.9 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause...7.0 High
- dimitri grassi salon booking systemSalon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback4.8 Medium
- unknown accept paypal & stripe with subscriptions for woocommerceRestore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment3.7 Low
- unknown accept paypal & stripe with subscriptions for woocommerceRestore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email5.3 Medium
- mndpsingh287 file managerBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch8.8 High
- saigroup saiadminsaithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload5.1 Medium
- systemd systemd-machinedsystemd-machined: unprivileged users can terminate arbitrary processes4.7 Medium
- nxp-auto-goldvip gvipnxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control5.1 Medium
- 3coresec trapdoor3CORESec Trapdoor DefaultFunction access control5.3 Medium
- mingsoft mcmsMingSoft MCMS ms-mdiy get information disclosure6.9 Medium
- mingsoft mcmsMingSoft MCMS ms-mdiy list information disclosure6.9 Medium
- solacewp solace extraSolace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure8.1 High
- hkuds nanobotHKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure4.8 Medium
- hkuds nanobotHKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control5.1 Medium
- sourcecodester photo share websiteSourceCodester Photo Share Website ajax.php save_upload unrestricted upload5.3 Medium
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.08.7 High
- tobit laboratories ag teamdavidTeamDavid: Denial of Service via endpoint 'internalRestart'9.2 Critical
- tobit laboratories ag teamdavidTeamDavid: Arbitrary File Write leading to Stored XSS8.5 High
- nltk, nltk nltk/nltk +1 moreImproper Access Control in nltk/nltk5.3 Medium
- v-secure jingyun antivirusV-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control8.5 High
- avast antivirusJiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control8.5 High
- deepcool displayserviceDeepCool DisplayService DeepCoolDisplayService.exe access control8.5 High
- microsoft azure logic appsAzure Logic Apps Information Disclosure Vulnerability9.6 Critical
- microsoft purview ediscoveryMicrosoft Purview eDiscovery Elevation of Privilege Vulnerability8.8 High
- sourcecodester online examination & learning management systemSourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload5.3 Medium
- wso2 api control plane, api manager, carbon api management implementation +3 more +5 moreAccess Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations9.0 Critical
- Show moreLoading…