CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- itsourcecode online pharmacy systemitsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload6.9 Medium
- codeastro payroll systemitsourcecode Payroll System admin_class.php save_settings unrestricted upload6.9 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.26.9 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.28.7 High
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.28.7 High
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.28.7 High
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.26.9 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.210.0 Critical
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.26.9 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.26.9 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.28.7 High
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.26.9 Medium
- nltkNLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer7.1 High
- joomgalleryfriends.net joomgallery extension for joomlaJoomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.06.9 Medium
- conekta group payment gateway, unknown conekta payment gateway +1 moreConekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery5.3 Medium
- lxc incusIncus has a project restriction bypass in instance copy across projects7.7 High
- lxc incusIncus has a project restriction bypass for custom volume copy across projects7.7 High
- codeastro online job portalCodeAstro Online Job Portal update-profile.php unrestricted upload5.3 Medium
- apache cloudstackApache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation9.1 Critical
- apache cloudstackApache CloudStack: Webhook Deliveries Incorrect Access4.3 Medium
- apache cloudstackApache CloudStack: Unauthorised comment creation and disclosure5.4 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API7.2 High
- unknown newpath wildapricotpress add-onNewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API5.3 Medium
- apple watchosThis issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4....2.4 Low
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability9.1 Critical
- wintercms winterWinter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata5.4 Medium
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label9.9 Critical
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload5.1 Medium
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.656.9 Medium
- No product listedDeDeCMS select_media_post.php unrestricted upload5.3 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) through the REST API in Splunk Enterprise6.0 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) through the REST API in Splunk Enterprise8.8 High
- splunk, splunk enterprise +1 moreImproper Access Control through Embedded Reports in Splunk Enterprise9.4 Critical
- splunk, splunk enterprise +1 moreImproper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise9.4 Critical
- splunk, splunk enterprise +1 moreImproper Access Control through Embedded Report REST API Requests in Splunk Enterprise9.4 Critical
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities10.0 Critical
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.36.9 Medium
- apache tomcatApache Tomcat: Bypass longest prefix security constraint9.1 Critical
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions9.8 Critical
- unknown wp mapsWP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation5.4 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR7.2 High
- No product listedThe Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker...6.8 Medium
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...8.6 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...8.2 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.5 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...7.3 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...5.3 Medium
- Show moreLoading…