Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,444 results · Clear filters · Feed
-
Medium 4.3
nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing a manipulation can lead to information discl…
-
Medium 4.2
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscriptio…
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.6. An app may…
-
Medium 6.5
An access issue was addressed with improved access restrictions. This issue is fixed in Safari 26.6, iOS 18.7.10 and iP…
-
Medium 4.6
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia …
-
Medium 5.5
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.8, macOS S…
-
Medium 4.3
mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads t…
-
Medium 5.0
NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of th…
-
Medium 5.1
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user t…
-
Medium 6.5
ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any paym…
-
Medium 5.4
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.
-
Medium 6.5
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions
Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-rela…
-
Medium 5.3
Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointme…
-
Medium 6.5
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.8
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.5
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.3
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Su…
-
Medium 6.3
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supp…
-
Medium 6.3
Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Suppor…
-
Medium 6.3
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). Supported v…
-
Medium 6.3
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supp…
-
Medium 6.3
Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Suppor…
-
Medium 5.3
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Medium 6.7
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Medium 6.1
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Support…
-
Medium 4.2
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 6.5
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 5.0
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 5.9
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). …
-
Medium 4.3
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supp…
-
Medium 5.4
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 6.5
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 5.4
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
Medium 6.3
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Lease Authoring…
-
Medium 6.6
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.3
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported ve…
-
Medium 6.6
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported ve…
-
Medium 6.5
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The …
-
Medium 6.3
Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Suppo…