Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,224 results · Feed
-
High 8.1
Improper Access Control of Web Admin Console in Progress WS_FTP Server
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
-
High 8.5
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.
-
Low 3.8
YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.…
-
Medium 6.5
Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows una…
-
Critical 9.1
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an expor…
-
Critical 9.1
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in ano…
-
High 7.5
Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.
-
Critical 9.1
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers …
-
High 7.5
Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized atta…
-
Critical 9.1
Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read an…
-
Medium 6.5
SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get…
-
High 8.8
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in s…
-
High 8.1
SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/control…
-
Medium 4.3
maotoumao MusicFreeDesktop Request Forwarder information disclosure
A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the …
-
Medium 6.9
Vite: `server.fs.deny` bypassed with queries
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is expo…
-
Medium 4.4
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacke…
-
High 8.6
HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to info…
-
Medium 5.3
WP Roster < 2.35 - Unauthenticated Roster Member Deletion
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
-
Medium 5.3
Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin…
-
Medium 5.3
Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark …
-
High 7.3
oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried …
-
Low 3.5
A public shared collective always allowed recipients of the link to create pages.
-
Medium 4.3
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card num…
-
Low 3.5
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or …
-
Medium 4.6
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for …
-
Medium 4.3
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("Y…
-
High 7.8
Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges t…
-
High 8.8
Privilege escalation in the DOM: UI Events & Focus Handling component
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 8.1
Site isolation issue in the DOM: Service Workers component
Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Medium 6.5
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through …
-
Critical 9.3
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxH…
-
Medium 4.7
SourceCodester Online Food Ordering System add_food.php unrestricted upload
A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. T…
-
Medium 5.3
OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectI…
-
Medium 5.3
TOTOLINK A950RG global.so getLanguageCfg information disclosure
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched …
-
High 7.5
An access issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Gold…
-
Medium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27, macOS Seq…
-
Medium 5.1
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11,…
-
High 8.2
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macO…
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Se…
-
Low 3.3
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An ap…