Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 8.6CVE-2025-39247 Public exploit
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated …
-
High 8.1
Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical sy…
-
High 7.3
SourceCodester Human Resource Information System editemployee_process.php unrestricted upload
A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Superadmin_Dashboard/process/editemployee_process.php. Such manipulation of the argument employee_file201…
-
High 7.3
SourceCodester Human Resource Information System editemployee_process.php unrestricted upload
A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin_Dashboard/process/editemployee_process.php. This manipulation of the argument employee_file201 causes …
-
High 7.5
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
-
High 8.1
unopim/unopim allows unauthorized product deletion via mass-delete endpoint
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected…
-
High 7.5
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive compon…
-
High 7.3
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell wit…
-
High 8.3
N-central Syslog Configuration Insecure Direct Object Reference
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
-
High 8.1
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast…
-
High 8.8
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers …
-
High 7.5
Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive compo…
-
High 7.5
Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components wi…
-
High 8.6
Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive compone…
-
High 7.7
IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunary
An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by alte…
-
High 8.5
Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control.
-
High 8.0
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) at…
-
High 7.1
External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the…
-
High 7.9
Azure Virtual Machines Spoofing Vulnerability
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
-
High 8.8CVE-2025-24999 Public exploit
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
-
High 8.5
Zed AI Agent Remote Code Execution
Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing user permission checks. An AI Agent could have exploited a permissions bypass vulnerability to creat…
-
High 7.3
oitcode samarium Create Product product unrestricted upload
A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product of the component Create Product Page. The manipulation leads to unrestricted upload. It is possible t…
-
High 7.8
Improper Access Control in Automotive Multimedia
Memory corruption while handling client exceptions, allowing unauthorized channel access.
-
High 7.5
Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Datab…
-
High 7.3
NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could…
-
High 8.6
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such …
-
High 7.3CVE-2025-29556 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restriction…
-
High 8.0CVE-2025-52289 Public exploit
A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privile…
-
High 7.8CVE-2025-50777 Public exploit
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Ac…
-
High 8.8
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS So…
-
High 8.8
An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system…
-
High 7.3
code-projects Exam Form Submission register.php unrestricted upload
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /register.php. The manipulation of the argument image leads to unrestricted upload. The attack may be in…
-
High 7.1
Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unautho…
-
High 7.3
code-projects Church Donation System admin_pic.php unrestricted upload
A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /members/admin_pic.php. The manipulation of the argument image leads to unrestricted upload.…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
High 8.1
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administr…
-
High 8.1
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that a…
-
High 8.6
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.3
Teledyne FLIR FB-Series O/FLIR FH-Series ID Production Tools production.html access control
A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functionality of the file /priv/production/production.html of the component Production Tools. The manipula…