Skip to content
OpenAdvisories

Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

21 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-48907 Exploited Public exploit Scanner template EPSS 85%

    Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

    A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

    joomlacontenteditor.net Joomla Content Editor (JCE) extension for Joomla Web / CMS
    KEV Jun 16, 2026
  • Critical 10.0
    CVE-2026-34908 Exploited Public exploit Scanner template EPSS 89%

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS d…

    Ubiquiti Express 7 UniFi OS Server UDM-Pro-Max Network devices
    KEV Jun 23, 2026
  • Critical 9.1
    CVE-2026-35616 Exploited Public exploit Scanner template EPSS 94%

    A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated att…

    Fortinet FortiClientEMS Network devices
    KEV Apr 6, 2026
  • Critical 10.0
    CVE-2026-21962 Exploited Public exploit EPSS 73%

    Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (comp…

    Oracle Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
    KEV Aug 24, 2026
  • Critical 9.1
    CVE-2025-12480 Exploited Scanner template EPSS 96%

    Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to ini…

    TrioFox TrioFox
    KEV Nov 12, 2025
  • Critical 9.3
    CVE-2024-40766 Exploited · Ransomware EPSS 18%

    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially le…

    SonicWall SonicOS Network devices
    KEV Sep 9, 2024
  • Critical 9.8
    CVE-2024-27348 Exploited Public exploit Scanner template EPSS 99%

    Apache HugeGraph-Server: Command execution in gremlin

    RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the…

    Apache Software Foundation Apache HugeGraph-Server org.apache.hugegraph:hugegraph-api org.apache.hugegraph:hugegraph-core Maven
    KEV Sep 18, 2024
  • Critical 9.8
    CVE-2023-24489 Exploited Public exploit Scanner template EPSS 97%

    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…

    Citrix Citrix ShareFile Storage Zones Controller Network devices
    KEV Aug 16, 2023
  • Critical 9.8
    CVE-2023-27350 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

    PaperCut NG
    KEV Apr 21, 2023
  • Critical 9.8
    CVE-2021-22941 Exploited · Ransomware Public exploit EPSS 54%

    Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2019-11634 Exploited · Ransomware

    Citrix Workspace App before 1904 for Windows has Incorrect Access Control.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-8735 Exploited EPSS 90%

    Apache Tomcat Improper Access Control vulnerability

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV May 12, 2023
  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-3427 Exploited EPSS 92%

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows re…

    openjdk-8 openjdk-7 openjdk-6 Ubuntu
    KEV May 12, 2023
  • Critical 10.0
    CVE-2015-3306 Exploited Public exploit Scanner template EPSS 99%

    The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and…

    proftpd-dfsg proftpd-dfsg Debian Ubuntu
    KEV Oct 8, 2026
  • Critical 9.8
    CVE-2015-1427 Exploited Public exploit Scanner template EPSS 100%

    Improper Access Control in Elasticsearch

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

    org.elasticsearch:elasticsearch Maven
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2013-0422 Exploited · Ransomware Public exploit EPSS 97%

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) usin…

    KEV May 25, 2022
  • Critical 9.8
    CVE-2012-5076 Exploited Public exploit EPSS 91%

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allo…

    KEV Mar 28, 2022
  • Critical 9.8
    CVE-2012-4681 Exploited · Ransomware Public exploit EPSS 99%

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow…

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2012-1723 Exploited · Ransomware Public exploit EPSS 94%

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 u…

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2011-3544 Exploited Public exploit EPSS 97%

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and…

    KEV Mar 3, 2022