Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
251 results · Clear filters · Feed
-
Critical 9.1
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated att…
KEV Apr 6, 2026 -
Critical 9.8
EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
-
Medium 6.5CVE-2026-29597 Public exploit
DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged u…
-
Medium 5.3CVE-2025-69727 Public exploit
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components …
-
Critical 9.9CVE-2025-66956 Public exploit
Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers …
-
Medium 5.3CVE-2026-3796 Public exploit
Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control
A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIO_Imp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access …
-
High 8.1CVE-2026-26417 Public exploit
A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Cli…
-
High 7.5CVE-2026-26418 Public exploit
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows re…
-
Critical 9.5CVE-2026-21627 Public exploit
Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
-
High 8.1CVE-2025-68721 Public exploit
Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delega…
-
Critical 9.8CVE-2026-24306 Public exploit
Azure Front Door Elevation of Privilege Vulnerability
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
-
Medium 6.3CVE-2026-24055 Public exploit
Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking
Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId i…
-
High 7.4CVE-2025-69822 Public exploit
An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive informat…
-
Critical 10.0
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (comp…
KEV Aug 24, 2026 -
Medium 5.8CVE-2026-21636 Public exploit
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `-…
-
High 7.5CVE-2025-64516 Public exploit
GLPI incorrectly authorizes access to documents
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anony…
-
High 7.5CVE-2026-20929 Public exploit
Windows HTTP.sys Elevation of Privilege Vulnerability
Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
-
Medium 4.7CVE-2025-15495 Public exploit
BiggiDroid Simple PHP CMS editsite.php unrestricted upload
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been made…
-
High 8.4CVE-2025-61229 Public exploit
An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to e…
-
High 8.1CVE-2025-57489 Public exploit
Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privil…
-
Medium 6.5CVE-2025-56499 Public exploit
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary …
-
High 7.5CVE-2025-63667 Public exploit
Incorrect access control in SIMICAM v1.16.41-20250725, KEVIEW v1.14.92-20241120, ASECAM v1.14.10-20240725 allows attack…
-
Critical 9.8CVE-2025-63353 Public exploit
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-…
-
Critical 9.8CVE-2025-63666 Public exploit
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and…
-
Medium 6.5CVE-2025-60876 Public exploit
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/qu…
-
High 7.8CVE-2025-43407 Public exploit
This issue was addressed with improved entitlements. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and …
-
High 7.8CVE-2025-61156 Public exploit
Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privi…
-
High 7.5CVE-2025-60800 Public exploit
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to acc…
-
High 7.1CVE-2025-56219 Public exploit
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiti…
-
High 7.5CVE-2025-58726 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
-
Critical 9.4CVE-2025-61777 Public exploit
FlagForge Allows Unauthenticated Badge Template API Access
Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints previously allowed access without authentication or authoriz…
-
Medium 6.5CVE-2025-57428 Public exploit
Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gai…
-
Medium 5.3CVE-2025-10952 Public exploit
geyang ml-logger File server.py stream_handler information disclosure
A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler of the file ml_logger/server.py of the component File Handler. Performing manipulation of the argumen…
-
Critical 10.0CVE-2025-54914 Public exploit
Azure Networking Elevation of Privilege Vulnerability
Azure Networking Elevation of Privilege Vulnerability
-
High 8.6CVE-2025-39247 Public exploit
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated …
-
Critical 9.8CVE-2022-43110 Public exploit
Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to con…
-
Medium 5.3CVE-2025-51529 Public exploit
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin t…
-
High 8.8CVE-2025-24999 Public exploit
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
-
Medium 5.4CVE-2025-29557 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where use…
-
High 7.3CVE-2025-29556 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restriction…