Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Low 3.5
AutoGPT allows cross-user sharing of node execution results through WebSockets API
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph_id+graph…
-
Medium 6.3
ZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted upload
A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of the file /admin/upload/authorImg/. The manipulation of the argument File leads to unrestricted upload.…
-
Medium 6.3
westboy CicadasCMS JSP Parser upload unrestricted upload
A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the …
-
High 7.3
veal98 小牛肉 Echo 开源社区系统 uploadMdPic unrestricted upload
A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. T…
-
Medium 4.7
huanfenz/code-projects StudentManager Announcement Management Section uploadArticle.do unrestricted upload
A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uploadArticle.do of the component Announcement Management Section. The manipulation of the argument File…
-
Medium 6.3
ghostxbh uzy-ssm-mall uploadUserHeadImage unrestricted upload
A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiat…
-
Medium 6.8
Visual Studio Code Elevation of Privilege Vulnerability
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
-
Low 3.3
An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, …
-
High 8.4
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
-
Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security…
-
Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security…
-
High 8.2
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low privileged attacker with local access could leverage this vulnerability to bypass security …
-
Critical 9.1CVE-2025-30281 EPSS 24%
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data wi…
-
High 7.5CVE-2025-29810 Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Windows Resilient File System (ReFS) Information Disclosure Vulnerability
Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.
-
High 8.4
Windows Defender Application Control Security Feature Bypass Vulnerability
Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
-
Medium 6.5
Windows NTFS Information Disclosure Vulnerability
Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
-
High 7.8
Microsoft Office Elevation of Privilege Vulnerability
Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
Medium 4.0
Shopware Broken ACL on Document retrieval to access other customers documents
### Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers ### Patches Update to Shopware 6.6.10.3 or 6.5.8.17 ### Workarounds For older versions of 6.4, corresponding security measures are also available via a plug…
-
Medium 6.3
mymagicpower AIAS LocalStorageController.java unrestricted upload
A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. The manipulation of th…
-
Medium 6.3
lenve VBlog WebSecurityConfig.java configure access control
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access contro…
-
High 7.3
Improper Access Control in Automotive Linux OS
Memory corruption may occur due top improper access control in HAB process.
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not pro…
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeControll…
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectD…
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
-
High 8.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} end…
-
High 7.2
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly val…
-
High 8.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} end…
-
Critical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
-
Medium 4.3
iteaj iboot 物联网网关 Admin Password pwd access control
A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls…
-
Medium 6.3
godcheese/code-projects Nimrod FileRestController.java unrestricted upload
A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted uplo…
-
Medium 4.3
1902756969/code-projects IKUN_Library Borrow MvcConfig.java addInterceptors access control
A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper a…
-
Medium 4.3
SourceCodester Online Eyewear Shop Registration Master.php access control
A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The m…
-
Medium 6.3
xujiangfei admintwo updateSet access control
A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/updateSet. The manipulation of the argument email leads to improper access controls. The attack may be …
-
Medium 4.3
xujiangfei admintwo home access control
A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/home. The manipulation of the argument ID leads to improper access controls. The attack can…