CWE-284 · Improper Access Control

6372 CVEs classified under CWE-284 (Improper Access Control). Browse by severity and year.

Top CVEs for CWE-284
CVESeverityScorePublishedSummary
CVE-2026-66803Critical10.02026-07-30Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
CVE-2026-58630Critical10.02026-07-24Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-60366Critical10.02026-07-22Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a…
CVE-2026-60358Critical10.02026-07-21Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12…
CVE-2026-50746Critical10.02026-07-02A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Inj…
CVE-2026-46978Critical10.02026-06-17Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easi…
CVE-2026-35308Critical10.02026-06-17Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). Supported versions that are affected are…
CVE-2026-35307Critical10.02026-06-17Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0…
CVE-2026-46695Critical10.02026-06-10Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prio…
CVE-2026-46840Critical10.02026-05-28Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulne…
CVE-2026-34908Critical10.02026-05-22A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to t…
CVE-2026-34234Critical10.02026-05-19CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerabl…
CVE-2026-34444Critical10.02026-04-06Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed thro…
CVE-2026-33478Critical10.02026-03-23WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to all…
CVE-2026-32737Critical10.02026-03-18Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub…
CVE-2026-30966Critical10.02026-03-10Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's inter…
CVE-2026-2768Critical10.02026-02-24Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-21962Critical10.02026-01-20Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…
CVE-2026-21636Critical10.02026-01-20A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `-…
CVE-2026-0881Critical10.02026-01-13Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.
All CVEs classified under CWE-284 — newest first (page 1 of 64)
CVESeverityScorePublishedSummary
CVE-2024-14046Medium6.32026-08-18A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/…
CVE-2026-42163Critical9.82026-08-17Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstanc…
CVE-2026-19992Low3.12026-08-17A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the…
CVE-2026-73061Critical9.82026-08-16Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without s…
CVE-2026-19711Medium6.52026-08-16The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any au…
CVE-2026-19918Medium6.32026-08-16A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Inte…
CVE-2026-14229Medium5.32026-08-15The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX…
CVE-2026-715702026-08-14Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` on…
CVE-2026-19839Medium4.72026-08-14A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. T…
CVE-2026-19837Low2.72026-08-14A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search…
CVE-2026-19835Low3.82026-08-14A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio…
CVE-2026-72837High8.82026-08-14File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid u…
CVE-2026-736642026-08-13FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SS…
CVE-2026-59763Medium4.32026-08-13Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
CVE-2026-58508Critical9.12026-08-13Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
CVE-2026-58507Medium5.32026-08-13Private Repository Existence Disclosure via go-get Meta Endpoint
CVE-2026-58440Medium6.82026-08-13Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocati…
CVE-2026-58439High8.12026-08-13Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
CVE-2026-58437High7.12026-08-13Repository Visibility Manipulation via Git Push Options
CVE-2026-58429Medium4.92026-08-13Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
CVE-2026-58420Medium4.42026-08-13Local File Inclusion via file:// URI in Migration Restore
CVE-2026-58417High7.52026-08-13REST API exposes organization membership of private organizations to public
CVE-2026-56755Medium6.22026-08-13Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
CVE-2026-56750Critical9.12026-08-13Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-56657Medium6.22026-08-13Gitea SSH Key Parser Denial of Service
CVE-2026-56654Critical9.82026-08-13Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-55986Medium5.42026-08-13Email Management API Bypasses ManageCredentials Feature Restrictions
CVE-2026-55984Low2.72026-08-13Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
CVE-2026-73626Unrated2026-08-13JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the…
CVE-2026-59505High8.62026-08-13CWE-284: Improper Access Control
CVE-2026-59501High8.22026-08-13CWE-284: Improper Access Control
CVE-2026-13328Medium5.32026-08-13The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed…
CVE-2026-13367High7.82026-08-12IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.
CVE-2026-59917High7.82026-08-12Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with l…
CVE-2026-59914High7.82026-08-12Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged at…
CVE-2026-672872026-08-12Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances…
CVE-2026-672842026-08-12Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-re…
CVE-2026-672832026-08-12Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-…
CVE-2026-16538Critical9.12026-08-12The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowi…
CVE-2026-14859Medium4.32026-08-12The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user…
CVE-2026-13171High8.22026-08-12The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to…
CVE-2026-732122026-08-11Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range()…
CVE-2026-66804High7.82026-08-11Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
CVE-2026-65773High7.82026-08-11Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-65675High7.12026-08-11No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-208982026-08-11Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. St…
CVE-2026-207892026-08-11Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivi…
CVE-2026-207412026-08-11Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adve…
CVE-2026-207162026-08-11Improper access control for some Intel(R) Processors within Ring 3: User Applications may allow an escalation of privilege. Simple hardware adversary with an a…
CVE-2026-72601High7.52026-08-11A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable i…
CVE-2026-72600High7.52026-08-11A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer…
CVE-2026-72596High8.12026-08-11A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model…
CVE-2026-72595High8.12026-08-11A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams vi…
CVE-2026-72563High8.12026-08-11A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams v…
CVE-2026-72561High8.82026-08-11A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the p…
CVE-2026-72555High8.12026-08-11A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causin…
CVE-2026-72554Medium6.52026-08-11A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging…
CVE-2026-72693High7.82026-08-11`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/…
CVE-2026-729092026-08-10ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpn…
CVE-2026-18951High8.82026-08-10A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permiss…
CVE-2026-13717High8.82026-08-10A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with…
CVE-2026-15060Medium4.72026-08-10When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged use…
CVE-2026-72575Critical9.12026-08-10An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup record…
CVE-2026-210842026-08-10Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
CVE-2026-210642026-08-10Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.
CVE-2026-17540High8.82026-08-10The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber…
CVE-2026-17023Medium4.82026-08-10The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar autho…
CVE-2026-17016Low3.72026-08-10The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total…
CVE-2026-17012Medium5.32026-08-10The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment m…
CVE-2026-19383Medium4.72026-08-10A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/…
CVE-2026-19359Medium4.72026-08-09A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component…
CVE-2026-19358Medium6.32026-08-09A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes impro…
CVE-2026-19357Medium5.32026-08-09A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The mani…
CVE-2026-19356Medium5.32026-08-09A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The ma…
CVE-2026-16948High8.12026-08-08The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on ad…
CVE-2026-19245Low3.32026-08-07A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of…
CVE-2026-19244Medium4.72026-08-07A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of t…
CVE-2026-19210Medium6.32026-08-07A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_…
CVE-2026-664942026-08-07Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious…
CVE-2026-542132026-08-07Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart…
CVE-2026-542082026-08-07Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into exist…
CVE-2026-12261Medium5.32026-08-07A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package arch…
CVE-2026-19195High7.82026-08-07A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Ke…
CVE-2026-19193High7.82026-08-07A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Exec…
CVE-2026-19192High7.82026-08-07A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCo…
CVE-2026-65668High8.82026-08-07Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
CVE-2026-56161Critical9.62026-08-07Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
CVE-2026-67687High8.82026-08-06Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java…
CVE-2026-19065Medium6.32026-08-06A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file up…
CVE-2025-14561Critical9.02026-08-06In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privil…
CVE-2026-55979Medium5.22026-08-06An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to…
CVE-2026-55978High8.42026-08-06An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communicatio…
CVE-2026-14829High8.22026-08-06The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-m…
CVE-2026-13703Medium5.42026-08-06The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in u…
CVE-2026-18995Medium4.32026-08-06A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParse…
CVE-2026-18993Medium6.32026-08-06A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_too…
CVE-2026-18974Medium5.32026-08-06A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execut…
CVE-2026-18969High7.32026-08-06A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dis…
CVE-2025-63822High8.12026-08-05SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass a…
CVE-2026-70612Medium5.42026-08-05Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, req…