Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

Architecture and Design, Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

1,004 results · Clear filters · Feed

Critical 9.1

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

Aug 31, 2026
Critical 9.1

CVE-2026-51692

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

Aug 31, 2026
Critical 9.1

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

Aug 31, 2026
Critical 9.1

CVE-2026-51722

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

Aug 31, 2026
Critical 9.8

CVE-2026-51684

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

Aug 31, 2026
Critical 9.1

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

Aug 31, 2026
Critical 9.1

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

Aug 31, 2026
Critical 9.1

CVE-2026-51698

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

Aug 31, 2026
Critical 9.1

CVE-2026-51677

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

Aug 31, 2026
Critical 9.8

CVE-2026-51705

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

Aug 31, 2026
Critical 9.8

CVE-2026-51693

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

Aug 31, 2026
Critical 9.1

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

Aug 31, 2026
Critical 9.8

CVE-2026-51696

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate…

Aug 31, 2026
Critical 9.8

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

Aug 31, 2026
Critical 9.1

CVE-2026-51717

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

Aug 31, 2026
Critical 9.8

CVE-2026-51686

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

Aug 31, 2026
Critical 9.8

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

Aug 31, 2026
Critical 9.1

CVE-2026-51676

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

Aug 31, 2026
Critical 9.1

CVE-2026-51736

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack…

Aug 31, 2026
Critical 9.8

CVE-2026-51708

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

Aug 31, 2026
Critical 9.1

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack…

Aug 31, 2026
Critical 9.1

CVE-2026-51721

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

Aug 31, 2026
Critical 10.0

CVE-2026-54745

Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/se…

kubeflow pipelines

Aug 28, 2026
Critical 9.8

CVE-2026-51645

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

Aug 28, 2026
Critical 9.1

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica…

Aug 28, 2026
Critical 9.8

CVE-2026-51663

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

Aug 28, 2026
Critical 9.8

CVE-2026-51611

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

Aug 28, 2026
Critical 9.1

CVE-2026-51646

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

Aug 28, 2026
Critical 9.1

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate…

Aug 28, 2026
Critical 9.1

CVE-2026-51626

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

Aug 28, 2026
Critical 9.1

CVE-2026-51643

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

Aug 28, 2026
Critical 9.1

CVE-2026-51660

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…

Aug 28, 2026
Critical 9.1

CVE-2026-51636

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

Aug 28, 2026
Critical 9.1

CVE-2026-51657

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

Aug 28, 2026
Critical 9.1

CVE-2026-51649

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

Aug 28, 2026
Critical 9.1

CVE-2026-51622

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

Aug 28, 2026
Critical 10.0

CVE-2026-18886

Unauthenticated Privilege Escalation via System Configuration Image Upload Processor

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended…

ServiceNow ServiceNow AI Platform

Aug 27, 2026
Critical 9.8

CVE-2026-37072 Public exploit

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updat…

Aug 27, 2026
Critical 9.8

CVE-2026-77557

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…

Ubiquiti UniFi Protect AI Key Network devices

Aug 26, 2026
Critical 9.9

CVE-2026-77553

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …

Ubiquiti UniFi Access Application Network devices

Aug 26, 2026