Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,224 results · Feed
-
High 8.8
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM …
-
Medium 5.3
CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maint…
-
Medium 5.3
TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
-
Medium 6.5
vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys
vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another requ…
-
Low 3.5
a2aproject a2a-rs inmemory.rs information disclosure
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be ca…
-
Medium 6.4
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Di…
-
Critical 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 7.7
Vulnerability in Oracle Essbase (component: Build). The supported version that is affected is 21.8.3.0.0. Easily exploi…
-
Critical 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
Critical 9.1
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0…
-
Medium 6.3
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
Critical 9.1
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 8.5
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0…
-
High 8.5
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0…
-
Medium 5.6
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult …
-
High 8.1
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult …
-
High 7.3
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
Critical 9.3
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
Critical 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
Critical 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 8.1
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult …
-
Medium 6.0
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
High 7.4
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
Critical 9.3
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
Medium 6.3
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, …
-
High 8.8
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2…
-
High 7.5
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
High 8.3
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform S…
-
Medium 5.4
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions t…
-
Medium 6.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platfor…
-
Medium 6.5
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
Medium 6.5
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). Supported vers…
-
High 7.7
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3…
-
Medium 6.4
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
Medium 4.4
Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft (component: Integratio…
-
Medium 4.4
Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory). Th…
-
Medium 4.4
Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Oracle PeopleSoft (component: Pro…
-
Medium 6.5
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version tha…
-
High 8.8
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
High 7.8
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform S…