Skip to content
OpenAdvisories

Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 3.3
    CVE-2026-106073 Public exploit

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • Low 3.6
    CVE-2026-106071 Public exploit

    A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…

    nodejs node nodejs nodejs Ubuntu Alpine
  • Low 3.3
    CVE-2026-58039 Public exploit

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • Low 3.8
    CVE-2026-22014 Public exploit

    Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events…

    Oracle Oracle User Management
  • Low 3.3
    CVE-2025-25618 Public exploit

    Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and …

  • Low 3.3
    CVE-2023-28197 Public exploit

    An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Bi…

    Apple macOS macOS
  • Low 2.2
    CVE-2022-24924 Public exploit

    An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system d…

    Samsung Mobile LiveWallpaper
  • Low 3.7
    CVE-2022-23134 Exploited Public exploit EPSS 95%

    Possible view of the setup pages by unauthenticated users if config file already exists

    After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

    Zabbix Frontend zabbix Debian
    KEV Feb 22, 2022
  • Low 3.7
    CVE-2013-2423 Exploited Public exploit EPSS 85%

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, an…

    KEV May 25, 2022