Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,215 results · Clear filters · Feed
-
High 7.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Su…
-
High 7.6
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
High 7.6
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
High 7.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…
-
High 7.8
A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue o…
-
High 7.8
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An …
-
High 7.3
vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remot…
-
High 7.3
light0011 cms Captcha Validation UserController.class.php access control
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. E…
-
High 8.1
Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or s…
-
High 8.8
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The end…
-
High 7.8
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a reposi…
-
High 7.1
Viewer role can create, modify and delete Loki alerting rules
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki ru…
-
High 7.5
Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-p…
-
High 7.2
InvoiceShelf bulk deletion lacks company scoping
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently bindi…
-
High 7.8
mise permits untrusted local configuration to override default shell arguments
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked g…
-
High 8.1
Gitea fork workflow approval bypass through concurrency cancellation
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocke…
-
High 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…
-
High 7.5
CAI Content Credentials | Improper Access Control (CWE-284)
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this …
-
High 7.5
CAI Content Credentials | Improper Access Control (CWE-284)
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this …
-
High 8.2
IBM WebSphere Application Server Liberty is affected by an improper access control
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 8.8
x86: XPTI may break on huge-memory systems
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. …
-
High 7.3CVE-2026-110025 Public exploit
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestri…
-
High 7.3
SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. Th…
-
High 7.3
SourceCodester E-Learning System Users.php save_users unrestricted upload
A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The ex…
-
High 7.3
SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can b…
-
High 7.7
IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
-
High 7.7
IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
-
High 7.0
ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation
The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/core/mmu.c). VM_ASID_BITS is 8, so only 255 ASIDs exist; once the counter wrapped, arch_mem_domain_init…
-
High 8.8
Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple interna…
-
High 8.3
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
-
High 8.8CVE-2026-104335 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.
-
High 8.1
Backstage: Scaffolder action input authorization bypass
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected …
-
High 8.8
Improper Access Control in HPE Networking ClearPass Android Client Application
An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote a…
-
High 8.2
Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged atta…
-
High 7.6
Payload: Field-level password update restrictions were not enforced
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collecti…
-
High 7.4
Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, toke…
-
High 8.7
Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants the…
-
High 8.1
Plane: Disabled User Auto-Reactivation on Login
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating t…
-
High 7.2
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-upd…