Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Critical 9.6
Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from…
-
High 7.7
Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service…
-
Medium 6.8
The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are inten…
-
Medium 6.3
academico-sis academico Profile Picture edit-photo unrestricted upload
A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality of the file /edit-photo of the component Profile Picture Handler. This manipulation causes unrestric…
-
Medium 6.3
Selleo Mentingo Content-Type unrestricted upload
A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation of the argument userAvatar results in unrestricted upload. The attack may be performed from remote.…
-
Medium 6.3
Selleo Mentingo Profile Picture unrestricted upload
A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Handler. The manipulation of the argument userAvatar leads to unrestricted upload. The attack is possi…
-
Medium 6.3
Airsonic-Advanced Playlist Upload unrestricted upload
A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing manipulation results in unrestricted upload. It is possible to initiate the attack remotely. The explo…
-
High 7.5
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corr…
-
Medium 6.3
itsourcecode E-Commerce Website users.php unrestricted upload
A security flaw has been discovered in itsourcecode E-Commerce Website 1.0. Affected is an unknown function of the file /admin/users.php. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been released to th…
-
Medium 6.3
itsourcecode E-Commerce Website products.php unrestricted upload
A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and…
-
Medium 6.3
Portabilis i-Educar enrollment-history access control
A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The e…
-
Medium 4.3
Portabilis i-Educar diarioApi information disclosure
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been…
-
High 7.3
SourceCodester Online Exam Form Submission register.php unrestricted upload
A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the argument img causes unrestricted upload. It is possible to initiate the attack remotely. The exploit …
-
High 7.5
Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
-
Medium 4.9
Authenticated Arbitrary File Read allows Data Exposure in CLI Interface
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
-
High 8.1
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distri…
-
Critical 9.1
A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with v…
-
Medium 5.2
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma …
-
Low 3.3
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14…
-
Low 3.3
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be ab…
-
Low 3.3
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…
-
Medium 5.5
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26. An app may be able …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS T…
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26. An app may b…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8,…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be ab…
-
Medium 5.5
This issue was addressed with improved entitlements. This issue is fixed in macOS Tahoe 26. An app may be able to acces…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8,…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma…
-
High 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 2…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be ab…
-
High 7.5
The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to overri…
-
Medium 5.5
The issue was resolved by blocking unsigned services from launching on Intel Macs. This issue is fixed in macOS Sequoia…
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS T…
-
Medium 5.5
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Son…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26 and iPadOS 26, macOS Taho…
-
High 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be ab…