Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.3
Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Payables). The support…
-
High 8.1
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0…
-
High 7.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
Medium 5.4
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Ord…
-
Medium 6.5
Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Ma…
-
Low 2.7
Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-2…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 4.3
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Upload Attachments). …
-
Medium 4.3
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Sup…
-
Medium 5.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). S…
-
Medium 6.1
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Application Logging Int…
-
Medium 6.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…
-
Medium 4.9
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards).…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.1
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supp…
-
High 8.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Medium 6.1
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions th…
-
Medium 6.5
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servi…
-
Medium 6.5
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Appl…
-
Medium 6.5
LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can…
-
High 8.8
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to U…
-
High 8.1
FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders…
-
High 8.1
FileRise improper ownership/permission validation allowed cross-tenant file operations
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized operations (view/delete…
-
Medium 4.3
In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000…
-
High 7.1CVE-2025-56219 Public exploit
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiti…
-
Medium 6.3
Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload
A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir.do?Action=Upload. Performing manipulation of the argument File results in unrestricted upload. The …
-
Critical 9.1
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file …
-
Medium 6.3
Sismics Teedy API Endpoint file access control
A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The explo…
-
Medium 6.5
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Or…
-
High 8.9
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, …
-
High 7.1
A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses…
-
High 7.1
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset …
-
Medium 5.5
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
-
High 7.8CVE-2025-59230 Exploited
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
KEV Oct 14, 2025 -
Medium 5.5
Windows Search Service Denial of Service Vulnerability
Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
-
High 7.5CVE-2025-58726 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Error Reporting Service Elevation of Privilege Vulnerability
Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.