Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.5
2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., co…
-
High 7.8CVE-2025-61156 Public exploit
Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privi…
-
High 7.5
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local netwo…
-
High 7.3
code-projects Simple Food Ordering System addproduct.php unrestricted upload
A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The attack may be initi…
-
High 7.5
Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot.
-
High 7.5CVE-2025-60800 Public exploit
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to acc…
-
High 7.3
code-projects Simple Food Ordering System editproduct.php unrestricted upload
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotel…
-
High 8.8
An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In …
-
High 7.3
Azure Event Grid System Elevation of Privilege Vulnerability
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
-
High 7.7
Azure Notification Service Elevation of Privilege Vulnerability
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Kottster app reinitialization can be re-triggered allowing command injection in development mode
Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments w…
-
High 7.2
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The support…
-
High 8.1
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0…
-
High 7.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
High 8.8
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to U…
-
High 8.1
FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders…
-
High 8.1
FileRise improper ownership/permission validation allowed cross-tenant file operations
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized operations (view/delete…
-
High 7.1CVE-2025-56219 Public exploit
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiti…
-
High 8.9
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, …
-
High 7.1
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses…
-
High 7.1
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset …
-
High 7.8CVE-2025-59230 Exploited
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
KEV Oct 14, 2025 -
High 7.5CVE-2025-58726 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Error Reporting Service Elevation of Privilege Vulnerability
Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
-
High 7.3
PowerShell Elevation of Privilege Vulnerability
Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
-
High 7.8
Azure Monitor Agent Elevation of Privilege Vulnerability
Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
-
High 7.8
Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability
Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Software Protection Platform (SPP) Elevation of Privilege Vulnerability
Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 7.3
ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted upload
A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. Such manipulation of the argument File …
-
High 7.3
ProjectsAndPrograms School Management System uploadNotes.php unrestricted upload
A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes…
-
High 7.3
ProjectsAndPrograms School Management System changeSllyabus.php unrestricted upload
A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of the file /assets/changeSllyabus.php. The manipulation of the argument File results in unrestricted …
-
High 7.3
ProjectsAndPrograms School Management System createNotice.php unrestricted upload
A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unknown function of the file /assets/createNotice.php. The manipulation of the argument File leads to un…
-
High 7.3
ProjectsAndPrograms School Management System editNotes.php unrestricted upload
A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function of the file /assets/editNotes.php. Executing manipulation of the argument File can lead to unrestri…
-
High 8.7
External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through …
-
High 8.8
SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains …