CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeImproper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote...6.5 Medium
- No product listedaaPanel common.py GetClientIp access control6.9 Medium
- @apostrophecms import-export, apostrophecms apostrophe +1 moreApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document5.4 Medium
- vitejs vite, vite-plus +1 moreVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine6.3 Medium
- draytek vigor2960DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload5.3 Medium
- nokia 1830 global express (gx)A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)7.8 High
- arizu-id fast-tunnelarizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload5.3 Medium
- apple xcodeThis issue was addressed by enforcing library validation on the affected binaries. This issue is...8.8 High
- apple ipados, macos, tvos +4 more +6 moreA privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27...5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreThis issue was addressed with improved validation of the caller's access. This issue is fixed in...5.5 Medium
- apple macosThe issue was addressed with improved handling of secure input state. This issue is fixed in...5.5 Medium
- apple macosAn access issue was addressed with improved access controls. This issue is fixed in macOS Golden...5.5 Medium
- mljar mercuryMercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass10.0 Critical
- vraj404 criminal-management-systemvraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload6.9 Medium
- ai-genius-automations octoallyai-genius-automations octoally index.ts information disclosure6.9 Medium
- dav-ee dairy-management-systemDav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure6.9 Medium
- quomodosoft elementsready addons for elementorElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization4.3 Medium
- unknown gateway for vantiv on wcGateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery5.3 Medium
- light0011 cmslight0011 cms Captcha Validation UserController.class.php access control6.9 Medium
- giteaGitea reactions accepted on locked issues and comments4.3 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route4.3 Medium
- unknown wp user manager, wp user manager user manager +1 moreWP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass5.3 Medium
- tandoorrecipes recipesTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content8.1 High
- ibm iIBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System5.4 Medium
- elated-themes frappeFrappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication5.3 Medium
- No product listedZ.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers...7.8 High
- No product listedELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role...8.8 High
- lycheeorg lycheeLychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous2.3 Low
- grafana enterprise, oss +1 moreViewer role can create, modify and delete Loki alerting rules7.1 High
- unknown spin wheelSpin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result6.5 Medium
- No product listedAn issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain...5.5 Medium
- tp-link systems inc. omada software controllerImproper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API7.5 High
- itsmeravitejak online-examination-systemitsmeravitejak Online-Examination-System dbtables.sql information disclosure6.9 Medium
- error311 fileriseFileRise renameFolder omits destination-parent authorization5.4 Medium
- invoiceshelfInvoiceShelf bulk deletion lacks company scoping7.2 High
- invoiceshelfInvoiceShelf trusts client-supplied document totals5.3 Medium
- getredash redashRedash: DuckDB query runner allows arbitrary file read/write via unrestricted external access9.3 Critical
- jdx misemise permits untrusted local configuration to override default shell arguments7.8 High
- giteaGitea private attachment disclosure through repository mismatch5.9 Medium
- giteaGitea private pull request title disclosure through markup4.3 Medium
- giteaGitea restricted-user SSH and GPG key metadata disclosure4.3 Medium
- giteaGitea restricted-user issue search disclosure4.3 Medium
- giteaGitea restricted-user activity and heatmap disclosure4.3 Medium
- giteaGitea fork workflow approval bypass through concurrency cancellation8.1 High
- giteaGitea required Actions check bypass through skipped workflows6.5 Medium
- giteaGitea restricted-user package visibility bypass4.3 Medium
- unknown wpcodeWPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass5.3 Medium
- unknown product feed for google shopping, microsoft advertising and 40+ channels for woocommerce merchantProduct Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration5.3 Medium
- trust payments gateway for woocommerce, unknown trust payments gateway for woocommerce +1 moreTrust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page6.5 Medium
- unknown embedpressEmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating5.3 Medium
- Show moreLoading…