Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
251 results · Clear filters · Feed
-
Medium 4.7CVE-2026-122158 Public exploit
InvoiceShelf MemberService.php create access control
A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].i…
-
High 7.1CVE-2026-106991 Public exploit
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or st…
-
High 7.3CVE-2026-116106 Public exploit
HeyCyan App FileProvider access control
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. T…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
Medium 4.3CVE-2026-101678 Public exploit
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is a…
-
High 7.3CVE-2026-110025 Public exploit
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestri…
-
Medium 5.3CVE-2026-108578 Public exploit
Neterbit NW-431F Embedded Web Server sms.json information disclosure
A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was con…
-
High 8.8CVE-2026-104335 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.
-
Medium 5.3CVE-2026-97332 Public exploit
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated …
-
Critical 9.3CVE-2026-76142 Public exploit
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions
-
Critical 9.8CVE-2026-55494 Public exploit
Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its …
-
Medium 5.3CVE-2026-79417 Public exploit
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privil…
-
High 7.3CVE-2026-101053 Public exploit
Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control
A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The atta…
-
Critical 9.2CVE-2026-97161 Public exploit
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
-
Critical 10.0CVE-2026-97163 Public exploit
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
-
High 8.8CVE-2026-94036 Public exploit
D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access co…
-
Medium 6.5CVE-2026-92099 Public exploit
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and clai…
-
Medium 4.7CVE-2026-92247 Public exploit
synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be ini…
-
Critical 9.8CVE-2026-90898 Public exploit
Bifrost unauthenticated remote code execution via MCP stdio client registration
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth…
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
KEV Sep 8, 2026 -
Critical 9.8CVE-2026-78745 Public exploit
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via…
-
Medium 5.3CVE-2026-37067 Public exploit
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unaut…
-
Critical 9.8CVE-2026-37072 Public exploit
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updat…
-
Medium 6.5CVE-2026-37070 Public exploit
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated…
-
Medium 5.3CVE-2026-37073 Public exploit
Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated …
-
Medium 6.9CVE-2026-66916 Public exploit
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, t…
-
Medium 5.3CVE-2026-13736 Public exploit
NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible…
-
Critical 9.8CVE-2026-68004 Public exploit
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP pu…
-
High 7.8CVE-2026-66804 Public exploit
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-19195 Public exploit
V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control
A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed lo…
-
High 7.8CVE-2026-19193 Public exploit
Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control
A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. …
-
High 8.8CVE-2026-67687 Public exploit
Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/ro…
-
Medium 6.3CVE-2026-71204 Public exploit
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
-
High 7.5CVE-2025-70962 Public exploit
Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials…
-
Medium 5.4CVE-2026-70481 Public exploit
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wro…
-
Medium 6.2CVE-2026-15430 Public exploit
CVE-2026-15430
Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected l…
-
Low 3.3CVE-2026-58039 Public exploit
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…
-
Critical 9.8CVE-2026-52134 Public exploit
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass a…