CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedIncorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...9.1 Critical
- No product listedIncorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...7.5 High
- No product listedIncorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015...7.5 High
- No product listedIncorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015...7.5 High
- No product listedIncorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...7.5 High
- No product listedIncorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015...7.5 High
- No product listedIncorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...7.5 High
- No product listedIncorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...7.5 High
- No product listedIncorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015...4.3 Medium
- No product listedIncorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015...4.3 Medium
- No product listedIncorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015...9.8 Critical
- No product listedIncorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreNone None None No publicly available exploits are known.3.1 Low
- adobe dimensionDimension Business Logic Flaw Allows Chained Backend Object Operations6.9 Medium
- servicenow ai platformUnauthenticated Privilege Escalation via System Configuration Image Upload Processor10.0 Critical
- johnson controls t2000T2000 open debug port5.2 Medium
- wibu-systems-ag codemeter-runtimeImproper Access Control in Local-Only Configuration Commands8.6 High
- unknown mobile app for woocommerce: shopapper mobile app builder service for woocommerceShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update4.3 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.16.9 Medium
- No product listedIncorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9...5.3 Medium
- No product listedVeno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access...9.8 Critical
- No product listedIncorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9...6.5 Medium
- No product listedIncorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project...5.3 Medium
- weblateorg weblateWeblate: Team-enforced 2FA is bypassed for global permissions4.4 Medium
- dell idrac9Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains...5.9 Medium
- ubiquiti inc unifi protect ai keyA malicious actor with access to the network could exploit an Improper Access Control...9.8 Critical
- ubiquiti inc unifi access applicationA malicious actor with access to the network and low privileges could exploit an Improper Access...9.9 Critical
- ubiquiti inc unifi connect display cast proA malicious actor with access to the network and under certain conditions could exploit an...9.0 Critical
- ubiquiti inc unifi network applicationA malicious actor with access to the network and high privileges could exploit an Improper Access...9.1 Critical
- ubiquiti inc unifi connect applicationA malicious actor with access to the network could exploit an Improper Access Control...8.2 High
- ubiquiti inc cloud gateways, cloud keys, dream machines +10 more +12 moreA malicious actor with access to the network and low privileges could exploit an Improper Access...9.9 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +10 more +12 moreA malicious actor with access to the network and low privileges could exploit an Improper Access...9.9 Critical
- nlnet labs nsdWrong interpretation of ACL ranges8.2 High
- admin by request (abr) by request (abr)Insecure PIN derivation mechanism in Admin By Request (ABR)8.8 High
- ericsson codecheckerPersonal access token delete filters on Session columns while deleting from PersonalAccessTokenDB1.2 Low
- unknown return refund and exchange for woocommerceWoo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation6.5 Medium
- unknown project managerWP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR5.4 Medium
- masaakitanaka booking packageBooking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters5.3 Medium
- unknown privacy policy generator, terms & conditions, gdpr, ccpa, cookie policy & disclaimer templatesWP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure6.5 Medium
- No product listeddisconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access...9.8 Critical
- No product listedA Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and...6.5 Medium
- No product listedIncorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user...7.5 High
birdUbuntuBird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key...9.8 Critical- google chromeImproper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- mervinpraison praisonaiBrowser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)9.1 Critical
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.405.1 Medium
- No product listedThe /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect...7.5 High
- No product listedGazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a...5.4 Medium
- No product listedA Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall)...4.3 Medium
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability....7.8 High
- Show moreLoading…