Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 7.9
Azure Virtual Machines Spoofing Vulnerability
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
-
High 8.8CVE-2025-24999 Public exploit
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
-
Medium 5.8
Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform…
-
Medium 6.5
Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before…
-
Medium 4.4
Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may a…
-
Medium 6.7
Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated use…
-
High 8.5
Zed AI Agent Remote Code Execution
Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing user permission checks. An AI Agent could have exploited a permissions bypass vulnerability to creat…
-
Medium 6.3
code-projects eBlog Site File Upload save-slider.php unrestricted upload
A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack…
-
Medium 6.3
zlt2000 microservices-platform FileController.java upload unrestricted upload
A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to u…
-
High 7.3
oitcode samarium Create Product product unrestricted upload
A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product of the component Create Product Page. The manipulation leads to unrestricted upload. It is possible t…
-
Medium 6.3
LitmusChaos Litmus login access control
A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The manipulation of the argument projectID leads to improper access controls. It is possible to initiate the…
-
Medium 6.3
Qiyuesuo Eelectronic Signature Platform Scheduled Task upload execute unrestricted upload
A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of the file /api/code/upload of the component Scheduled Task Handler. The manipulation of the argument F…
-
Medium 6.3
linlinjava litemall upload unrestricted upload
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack r…
-
Medium 5.3
zlt2000 microservices-platform Spring Actuator Interface actuator information disclosure
A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /actuator of the component Spring Actuator Interface. The manipulation leads to information disclos…
-
Medium 6.5
OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing al…
-
Medium 4.3
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into S…
-
Medium 5.3
SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated acto…
-
Medium 6.5
-
High 7.8
Improper Access Control in Automotive Multimedia
Memory corruption while handling client exceptions, allowing unauthorized channel access.
-
Medium 5.3
4C Strategies Exonaut before v22.4 was discovered to contain an access control issue.
-
Critical 9.8
An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or …
-
Medium 6.5
Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high priv…
-
High 7.5
Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Datab…
-
Medium 5.5
Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)
Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variab…
-
Medium 6.5
An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters …
-
Medium 6.5
Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-l…
-
Medium 6.5
An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the…
-
Medium 6.3
Exrick xboot UploadController.java upload unrestricted upload
A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation…
-
Medium 5.3
Exrick xboot Spring Boot Admin/Spring Actuator information disclosure
A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the att…
-
Low 2.7
givanz Vvveb Drag-and-Drop Editor editor information disclosure
A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to infor…
-
Low 3.1
Intelbras InControl JSON Endpoint operador information disclosure
A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoint. Executing manipulation can lead to information disclosure. It is possible to launch the attack r…
-
Medium 6.3
code-projects Kitchen Treasure userregistration.php unrestricted upload
A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate…
-
High 7.3
NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could…
-
Critical 9.8
Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The m…
-
Medium 4.7
Campcodes Online Hotel Reservation System edit_room.php unrestricted upload
A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_room.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initi…
-
Medium 6.3
openviglet shio ShStaticFileAPI.java shStaticFileUpload unrestricted upload
A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument filename…
-
High 8.6
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such …
-
Medium 5.4CVE-2025-29557 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where use…
-
High 7.3CVE-2025-29556 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restriction…