CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Scaffolder action input authorization bypass8.1 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Improper Access Control in HPE Networking ClearPass Android Client Application8.8 High
- mispMISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change6.9 Medium
- dell system updateDell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability....8.2 High
- payloadcms payloadPayload: Field-level password update restrictions were not enforced7.6 High
- payloadcms payloadPayload: Field access control bypass on auth collections9.3 Critical
- unknown file media renamerFile Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat5.5 Medium
- penpotPenpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create5.4 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload5.3 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability6.5 Medium
- makeplane planePlane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token7.4 High
- makeplane planePlane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects8.7 High
- makeplane planePlane: Disabled User Auto-Reactivation on Login8.1 High
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access5.9 Medium
- No product listedFeehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator...7.2 High
- verint verbaWeaviate Verba generate_stream Endpoint util.py get_environment information disclosure6.9 Medium
- unknown user private filesUser Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)5.3 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Support Ticket API customer information disclosure5.3 Medium
- apache software foundation traffic serverApache Traffic Server: SNI to Host header matching policy is not properly enforced7.0 High
- mispMISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View5.3 Medium
- mispMISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data7.1 High
- onetwothreeneth hospitalmanagementsystemonetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload6.9 Medium
- niteothemes cmp – coming soon & maintenanceCMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match5.3 Medium
- popup maker maker, unknown popup maker +1 morePopup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect4.3 Medium
- No product listedTransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in...7.5 High
- No product listedTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool...9.8 Critical
- No product listedTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent...8.8 High
- No product listedSuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution...9.8 Critical
- No product listedSuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller...8.1 High
- No product listedIn SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, ...4.3 Medium
- apache http serverApache HTTP Server: mod_proxy_ftp PASV address handling7.5 High
- unknown wp fusion liteWP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion5.4 Medium
- formtools.org form toolsformtools.org Form Tools Ajax actions.php uploadFile unrestricted upload5.3 Medium
- genians, inc genian nac 5.0.75 lts release, genian nac 5.0.85 release stable, genian nac 5.0.86 release +3 more +5 moreGenians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface9.3 Critical
- david-crty databasementDavid-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control5.3 Medium
- No product listedRAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app)....9.8 Critical
- No product listedinfiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py)....6.5 Medium
- No product listedRagflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps...6.5 Medium
- No product listedinfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable...6.5 Medium
- No product listedinfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An...9.8 Critical
- No product listedinfiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.6.5 Medium
- No product listeddeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in...4.3 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Privilege Escalation through Improper Access Control7.2 High
- quenary tugtainerTugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset9.8 Critical
- quenary tugtainerTugtainer: OIDC login remains accessible when OIDC_ENABLED is false9.4 Critical
- mispMISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection8.6 High
- creative motion robin image optimizerRobin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax4.3 Medium
- unknown vayu xVayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation7.1 High
- unknown user frontendWP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled5.3 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure6.9 Medium
- Show moreLoading…