Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 5.3
Flowsint: Broken Access Control allows reading of sketch logs from any user
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.
-
Medium 5.3
GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint
GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization che…
-
Critical 9.3CVE-2026-44225 Public exploit
Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files
Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to …
-
Medium 4.9
Authenticated Arbitrary File Download via AOS-10 Web-Based Management Interface
A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the…
-
High 8.8
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS …
-
Medium 5.3
linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted
linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonli…
-
High 7.7
Microsoft Office Spoofing Vulnerability
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
-
Critical 9.9
Azure Logic Apps Elevation of Privilege Vulnerability
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
Medium 4.4
Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability
Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.
-
Medium 6.2
M365 Copilot for Desktop Spoofing Vulnerability
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.
-
High 7.1
Microsoft PowerPoint for Android Spoofing Vulnerability
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
-
Medium 4.4
Microsoft 365 Copilot for Android Spoofing Vulnerability
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
-
High 7.1
Microsoft Word for Android Spoofing Vulnerability
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
-
High 7.8
Windows Event Logging Service Elevation of Privilege Vulnerability
Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.
-
Critical 9.1CVE-2026-44277 Public exploit
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthentica…
-
High 8.8
Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a de…
-
Medium 6.0
Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history
Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited awa…
-
Low 3.1
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_al…
-
Low 3.3
An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iP…
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be …
-
Medium 5.5
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS …
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS …
-
Low 3.3
This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app m…
-
High 7.5
A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able…
-
High 7.5
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPad…
-
High 8.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sono…
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 1…
-
Critical 9.9
pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authentica…
-
Medium 6.4
Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to configure adaptive aut…
-
Medium 4.6
Dotouch XproUPF access control
A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The exploitability is told…
-
Critical 9.4
phpvms: /importer authorization bypass causing full database wipe
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.
-
Medium 6.8
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated …
-
High 8.8
Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execu…
-
Medium 5.3
Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys
Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An authenticated, low-privileged user of role “member” in a proje…
-
High 8.1
Dapr: Service Invocation path traversal ACL bypass
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows b…
-
High 8.5CVE-2026-8069 Public exploit
PredatorSense V3: Local Privilege Escalation (LPE) vulnerability
PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any auth…