CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- gedelumbung hospitalmanagementgedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload5.3 Medium
- No product listedDB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.9.8 Critical
- No product listedagentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers...9.8 Critical
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.37.0 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.35.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.37.0 High
- nagios host, teamviewer full client +1 moreRemote Session Access Control Bypass Leading to Remote Code Execution8.8 High
- mwasikz robo-cafe-rmsmwasikz robo-cafe-rms manage-food.php unrestricted upload5.1 Medium
- No product listedImproper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier...5.3 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape in the DOM: Navigation component9.6 Critical
- eleveo quality managementEleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software Query Builder searchAction.do access control5.3 Medium
- eleveo quality managementEleveo Quality Management QMBODownload information disclosure5.3 Medium
- watchguard apWatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access9.3 Critical
- No product listedPMWeb encryptionhelper.dll information disclosure6.9 Medium
- acrel electric unet web serviceAcrel Electric Unet Web Service Upload Endpoint upload unrestricted upload5.3 Medium
- manageengine ddi centralAuthenticated Broken Access Control8.8 High
- thinkware u3000Thinkware U3000 TCP Service GET_STATUS information disclosure6.9 Medium
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control6.9 Medium
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control6.9 Medium
- No product listedEyeplus p2pcam Service snapshot information disclosure6.9 Medium
- No product listedEyeplus ONVIF Device GetUsers information disclosure6.9 Medium
- krayin laravel-crmKrayin laravel-crm acl.php access control5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes6.2 Medium
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.299.2 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.2910.0 Critical
- cap-go capgo.appcapgo.app Content-Lock Bypass via r2-direct Bundle Mutation5.3 Medium
- actualbudget actualActual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token7.1 High
@openzeppelin/confidential-contractsnpmOpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet7.1 High- zammadZammad: Titles of knowledge base answers will be shown across all categories via the global search2.1 Low
- No product listedIncorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2...7.5 High
- servicenow ai platformUnauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform8.7 High
- servicenow ai platformUnauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform8.7 High
- mauriceboe trekTREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)5.3 Medium
- mauriceboe trekTREK MCP trip summary bypasses delegated OAuth read scopes4.3 Medium
- zitadelZITADEL: Actions V1 sandbox escape: host file read via require()8.7 High
- termix-ssh termixTermix: Authenticated users can read other users' host status and clear global SSH connections5.4 Medium
- No product listedO2OA Cipher Connection CipherConnectionAction.java list information disclosure5.3 Medium
- delta electronics diaenergieImproper Access Control in DIAEnergie6.5 Medium
- syed balkhi wpformsWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent6.8 Medium
- spon communications ip network audio device xc-9603SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure6.9 Medium
- intelliants subrion cmsIntelliants Subrion CMS actions.json assign-owner information disclosure6.9 Medium
- kvcache-ai mooncakekvcache-ai mooncake MountSegment Request Processing segment.cpp access control5.3 Medium
- lb-link bl-cpe600euLB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure6.9 Medium
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.07.2 High
- brocade sannavInsecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow...8.7 High
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.08.6 High
- neethuharii cafemanagementNeethuharii CafeManagement AddProductCode.php unrestricted upload6.9 Medium
- Show moreLoading…