CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Also known as Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26...4.6 Medium
- apple macosThis issue was addressed with improved permissions checking. This issue is fixed in macOS Golden...9.0 Critical
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and...5.5 Medium
- apple ipados, visionos, ios and ipados +1 more +3 moreAn access issue was addressed with improved access restrictions. This issue is fixed in iOS 27.2...5.5 Medium
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...8.2 High
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2...5.5 Medium
- apple macosA file access issue existed with certain home folder files. This was addressed with improved...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2,...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...7.5 High
- octoprintOctoPrint API Key settings.py getSettings information disclosure6.9 Medium
- No product listedKameleo Local API user-info information disclosure5.3 Medium
- No product listedKameleo Local API profiles information disclosure5.3 Medium
- No product listedKameleo Cookie Controller w.cs CookieController.ListCookies information disclosure5.3 Medium
- No product listedKameleo Profile Controller t.cs ListProfiles information disclosure4.8 Medium
- oray pugongying x5 proOray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload8.6 High
- unknown mintpay for woocommerceMintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery6.5 Medium
- unknown ccavenue payment gateway for woocommerceCCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery5.3 Medium
- nocodbNocoDB Sign-in Endpoint AuthService.validateUser information disclosure6.3 Medium
- No product listedGouGuOA Api.php chunkUpload unrestricted upload5.3 Medium
- openbq-org openbbopenbq-org OpenBB Local API Server api_settings.py access control5.3 Medium
- No product listedHeyCyan App FileProvider access control6.9 Medium
- collabora kodexplorerKodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload5.3 Medium
- prasathmani tinyfilemanagerprasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload5.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification3.7 Low
- rustaurius front end usersFront End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment6.5 Medium
- nodejs nodeA flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not...3.6 Low
- nodejs nodeA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the...3.3 Low
- nodejs nodeA flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated...7.4 High
- lxc incusIncus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy8.3 High
- hewlett packard enterprise (hpe) arubaos (aos)Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface7.2 High
- masscodeio masscodemassCodeIO massCode Local HTTP Service index.ts information disclosure5.3 Medium
- splunk soarImproper Access Control in Splunk SOAR9.8 Critical
- splunk enterpriseSecurity Hardening in Splunk Enterprise - October 20269.9 Critical
- splunk, splunk enterprise +1 moreImproper Access Control through Scheduled Search Safeguards in Splunk Enterprise8.8 High
- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...9.1 Critical
- momotommy file-management-systemfile-management-system FileController.php store unrestricted upload6.9 Medium
- oretnom23 file-management-system-phporetnom23 file-management-system-php admin_class.php save_files unrestricted upload6.9 Medium
- cisco emergency responder, unified communications manager, unity connection +1 more +3 moreCisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities8.8 High
- niteothemes cmp – coming soon & maintenanceCMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist5.3 Medium
- templateinvaders ti woocommerce wishlistTI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key5.3 Medium
- vllmvLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys7.1 High
- a2aproject a2a-rsa2aproject a2a-rs inmemory.rs information disclosure5.1 Medium
- oracle essbaseVulnerability in Oracle Essbase (component: Security). The supported version that is affected...9.9 Critical
- oracle essbaseVulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is...6.4 Medium
- oracle essbaseVulnerability in Oracle Essbase (component: Build). The supported version that is affected is...7.7 High
- oracle essbaseVulnerability in Oracle Essbase (component: Security). The supported version that is affected...9.9 Critical
- oracle essbaseVulnerability in Oracle Essbase (component: Federated Partitions). The supported version that...9.1 Critical
- oracle essbaseVulnerability in Oracle Essbase (component: Security). The supported version that is affected...9.1 Critical
- oracle essbaseVulnerability in Oracle Essbase (component: Security). The supported version that is affected...6.3 Medium
- oracle essbaseVulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that...8.5 High
- Show moreLoading…