CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown wpbotWPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions5.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass5.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API6.5 Medium
- unknown temporary login without passwordTemporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords5.5 Medium
- unknown booking for appointments and events calendarAmelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass5.3 Medium
- cloud foundry foundation uaa, cloud foundry cf-deployment +1 moreFederated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin9.2 Critical
- arraytics wpcafeWPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure...9.4 Critical
- cap-go capgo.appCapgo SSO Provider Authentication Bypass via PostgREST Direct Write9.3 Critical
- hikvision hikcentral access controlThere is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege...7.1 High
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.46.9 Medium
- unknown ultimate gift cards for woocommerceUltimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase7.5 High
- alfio-event alf.ioalf.io has Improper Access Control for Organization Owners that Exposes System Secrets7.1 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface5.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy5.3 Medium
- unknown wp travel, wp travel travel +1 moreWP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset3.7 Low
- samsung mobile watch pluginImproper access control in Watch Plugin prior to Android Watch 17 allows local attackers to...2.1 Low
- samsung collectionImproper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in...5.9 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to...6.9 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers...6.9 Medium
- No product listedIn RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in...4.3 Medium
- ibm enterprise build of quarkusIBM Enterprise Build of Quarkus is affected by multiple vulnerabilities5.3 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Access Control (CWE-284)7.5 High
- itsourcecode student management systemningzichun Student Management System Backup example.7z information disclosure6.9 Medium
- microsoft windows, windows 11 version 23h2, windows 11 version 24h2 +8 more +10 moreWindows Update Stack Elevation of Privilege Vulnerability7.8 High
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreSQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreSQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability8.8 High
- fortinet fortimanager, fortimanager cloud +1 moreAn improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4,...4.7 Medium
- fortinet fortisandbox, fortisandbox cloud, fortisandbox paas +2 moreA improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,...8.9 High
- fortinet fortisoar on-premise, fortisoar paas +1 moreA improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR...4.9 Medium
- aircheng-org iwebshop-5aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload6.9 Medium
- code-projects student crud operationcode-projects Student Crud Operation Backup File card_activation.sql information disclosure6.9 Medium
- java-json-tools json-patchjava-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control5.3 Medium
- No product listedAn issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into...9.8 Critical
- No product listedIncorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0...9.1 Critical
- light0011 cmslight0011 cms Debug Mode config.php information disclosure6.9 Medium
- light0011 cmslight0011 cms Upload.class.php upload unrestricted upload6.9 Medium
- code-projects hospital information systemcode-projects Hospital Information System SQL Database Backup File his.sql information disclosure6.9 Medium
- bookstackapp bookstackBookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control5.3 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System CommonController.java getOption information disclosure6.9 Medium
- beijing meite software technology u+smart enjoyment websiteBeijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload6.9 Medium
- liufee feehicmsliufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload6.9 Medium
- No product listedJeecgBoot AiragModelController.java exportXls access control5.3 Medium
- code-projects hotel and tourism reservation in phpcode-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure6.9 Medium
- brokercap bifrostUnauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds8.1 High
- Show moreLoading…