Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Critical 9.8
An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authen…
-
Critical 9.8CVE-2024-42919 Public exploit
eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.
-
Medium 4.3
Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control
A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipu…
-
Medium 4.3
Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access control
A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is an unknown function of the file /Report/ParkCommon/GetParkInThroughDeivces. The manipulation leads to…
-
Medium 5.3
Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control
A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue affects some unknown processing of the file /report/ParkChargeRecord/GetDataList. The manipulation l…
-
Medium 6.5
Improper Access Control in corydolphin/flask-cors
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant secu…
-
Critical 9.8
Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration fi…
-
High 8.8
Improper access control in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before …
-
High 7.9
improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to …
-
Medium 5.5
Improper access control for some Intel(R) CIP software before version 2.4.10717 may allow an authenticated user to pote…
-
Medium 5.0
Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow …
-
High 7.8
Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated u…
-
Medium 4.3
Being able to import/export tax rates without proper privileges
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security m…
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Windows Update Stack Elevation of Privilege Vulnerability
-
Medium 6.8
Windows Initial Machine Configuration Elevation of Privilege Vulnerability
Windows Initial Machine Configuration Elevation of Privilege Vulnerability
-
High 7.8
Azure CycleCloud Remote Code Execution Vulnerability
Azure CycleCloud Remote Code Execution Vulnerability
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Azure Connected Machine Agent Elevation of Privilege Vulnerability
-
High 7.3
Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attack…
-
Medium 4.7
An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through …
-
Medium 6.8
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected …
-
Medium 4.7
Improper Access Control in SAP Netweaver Application Server ABAP
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application …
-
High 8.1
Kamaji's RBAC Roles for `etcd` are not disjunct
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control…
-
Critical 9.8
A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam …
-
Medium 6.5
Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 a…
-
High 8.6
Vonets WiFi Bridges Improper Access Control
Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication and factory reset the device via unprot…
-
Medium 4.2
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a u…
-
Medium 5.3
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the…
-
Medium 6.9
Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability w…
-
High 7.3
Windows Update Stack Elevation of Privilege Vulnerability
Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization…
-
Medium 6.7
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how t…
-
Medium 5.3
SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_r…
-
Critical 9.8
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware fla…
-
High 7.3
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Managemen…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management…
-
Medium 5.3
An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management S…
-
Medium 5.3
An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Managemen…
-
Medium 6.5
An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teache…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management S…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kaship…