Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.1
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS…
-
High 7.3
SourceCodester Online Student Clearance System edit-photo.php unrestricted upload
A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. Th…
-
High 8.1
Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability
Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
-
High 7.5CVE-2025-29448 Public exploit
Easy!Appointments Denial of Service (DoS)
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.
-
High 7.8
Improper Access Control in Camera Driver
Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.
-
High 7.8
Improper Access Control in Camera Driver
Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.
-
High 7.8
Improper Access Control in Hypervisor
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
-
High 7.5
Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sen…
-
High 7.5
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive informatio…
-
High 7.5
Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive informat…
-
High 7.5
Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive in…
-
High 7.5
Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensi…
-
High 7.5
Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file …
-
High 7.5
Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access se…
-
High 7.1
An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi networ…
-
High 7.3
Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauth…
-
High 8.8CVE-2025-27134 Scanner template
Privilege escalation in Joplin server via user patch endpoint
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit t…
-
High 7.6
A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that…
-
High 7.3
ScriptAndTools Online-Travling-System addpackage.php access control
A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/addpackage.php. The manipulation leads to improper access controls. The attack may be initiate…
-
High 7.3
ScriptAndTools Online-Travling-System addadvertisement.php access control
A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/addadvertisement.php. The manipulation leads to improper access controls. The attack can be in…
-
High 7.5
Unauthenticated change of IP adress
A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device.
-
High 7.6
Dify Allows Unauthorized Access and Modification of APP Orchestration
Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-adm…
-
High 7.3
Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions…
-
High 8.8
Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacke…
-
High 7.4
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, …
-
High 8.1
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page …
-
High 7.5
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that …
-
High 7.5
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Supported versions …
-
High 7.2
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is af…
-
High 7.4
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.3
veal98 小牛肉 Echo 开源社区系统 uploadMdPic unrestricted upload
A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. T…
-
High 8.4
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
-
High 8.2
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low privileged attacker with local access could leverage this vulnerability to bypass security …
-
High 7.5CVE-2025-29810 Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
-
High 8.4
Windows Defender Application Control Security Feature Bypass Vulnerability
Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
Microsoft Office Elevation of Privilege Vulnerability
Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
High 7.3
Improper Access Control in Automotive Linux OS
Memory corruption may occur due top improper access control in HAB process.
-
High 8.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} end…
-
High 7.2
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly val…