Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.5
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …
-
High 7.5
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …
-
High 7.5
Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic…
-
High 8.6
Improper Access Control in Local-Only Configuration Commands
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers.…
-
High 8.2
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…
-
High 8.2
Wrong interpretation of ACL ranges
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access cou…
-
High 8.8
Insecure PIN derivation mechanism in Admin By Request (ABR)
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
-
High 7.5
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted re…
-
High 7.5
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. T…
-
High 7.8
Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged atta…
-
High 7.3
itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted uploa…
-
High 7.3
itsourcecode Payroll System admin_class.php save_settings unrestricted upload
A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has be…
-
High 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
-
High 8.7
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.
-
High 8.7
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table
-
High 8.7
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.
-
High 7.7
Incus has a project restriction bypass in instance copy across projects
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project…
-
High 7.7
Incus has a project restriction bypass for custom volume copy across projects
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in tha…
-
High 7.2
Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI P…
-
High 8.8
Remote Code Execution (RCE) through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed s…
-
High 7.2
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
-
High 8.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 8.6
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 8.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 8.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 8.2
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.5
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…
-
High 7.3
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions…