Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
350 results · Clear filters · Feed
-
Low 2.6
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.3
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and …
-
Low 3.0
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and …
-
Low 3.4
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and …
-
Low 3.7
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.8
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.5
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 3.3
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security).…
-
Low 3.0
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and …
-
Low 3.1
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supporte…
-
Low 2.0
FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array o…
-
Low 2.3
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, orig…
-
Low 3.1
Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure
A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. Th…
-
Low 2.7
Webkul Bagisto Customer Search search information disclosure
A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may …
-
Low 3.8
Webkul Bagisto Customer Item Deletion Endpoint access control
A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely…
-
Low 2.7
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
-
Low 3.7
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total an…
-
Low 3.3
HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disc…
-
Low 2.7
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as p…
-
Low 3.7
HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization.
-
Low 3.7
Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes
The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party in…
-
Low 3.3CVE-2026-58039 Public exploit
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…
-
Low 3.8
Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all cu…
-
Low 3.8
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
-
Low 3.7
Improper access control vulnerability
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.
-
Low 3.7
Improper access control vulnerability
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.
-
Low 2.9
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported…
-
Low 3.3
Vulnerability in the PeopleSoft Enterprise FIN Engineering Argentina product of Oracle PeopleSoft (component: Engineeri…
-
Low 1.9
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). …
-
Low 3.8
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported ver…
-
Low 3.1
Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Sup…
-
Low 3.1
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Low 3.4
Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Operations). Supported …
-
Low 2.0
Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Definition). Support…
-
Low 3.7
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Th…
-
Low 3.1
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions t…
-
Low 3.7
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability Security)…
-
Low 3.6
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure …
-
Low 3.6
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). T…
-
Low 2.2
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported ve…