Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 8.1
unopim/unopim allows unauthorized product deletion via mass-delete endpoint
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected…
-
Critical 9.8CVE-2022-43110 Public exploit
Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to con…
-
High 7.5
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive compon…
-
Critical 9.8
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive compon…
-
High 7.3
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell wit…
-
Medium 5.3
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime -…
-
Critical 9.8
Azure Databricks Elevation of Privilege Vulnerability
Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
-
High 8.3
N-central Syslog Configuration Insecure Direct Object Reference
On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
-
Medium 4.7
Emlog Pro blogger.php unrestricted upload
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the atta…
-
High 8.1
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast…
-
Critical 9.1
An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. T…
-
Medium 5.3
Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attack…
-
High 8.8
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers …
-
Medium 5.3
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitraril…
-
Medium 5.3
Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attacker…
-
Medium 4.3
elunez eladmin info information disclosure
A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been release…
-
Medium 4.9
Cisco Identity Services Engine Arbitrary File Upload Vulnerability
A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. …
-
High 7.5
Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive compo…
-
Critical 9.8
Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a …
-
Critical 9.8
Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a …
-
Critical 9.8
Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted pa…
-
High 7.5
Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components wi…
-
High 8.6
Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive compone…
-
Medium 6.3
itsourcecode Online Tour and Travel Management System travellers.php unrestricted upload
A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted upload. The attack …
-
Medium 4.3
Scada-LTS WatchListDwr.init.dwr information disclosure
A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be perfo…
-
Medium 5.3
A security issue has been identified in Appian Enterprise Business Process Management version 25.3. The vulnerability i…
-
Medium 4.3
A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical…
-
Medium 5.3
EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insuffici…
-
Medium 5.3CVE-2025-51529 Public exploit
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin t…
-
High 7.7
IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunary
An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by alte…
-
Medium 6.3
Acrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted upload
A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate …
-
High 8.5
Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control.
-
Low 3.1
Buttercup buttercup-browser-extension Vault access control
A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from …
-
Medium 5.3
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Bypass Vulnerability
A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker t…
-
Medium 6.3
linlinjava litemall Endpoint AdminStorageController.java create unrestricted upload
A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipul…
-
Medium 5.3
A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to …
-
High 8.0
A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) at…
-
Medium 6.5
The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, wh…
-
High 7.1
External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access
External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the…
-
Medium 6.8
INSTAR 2K+/4K UART improper physical access control
A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack on the physical devic…