CWE-284 · Improper Access Control (page 38)
Page 38 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2205 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication H… |
CVE-2026-2075 | Medium | 6.3 | 2026-02-07 | A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file… |
CVE-2026-25758 | High | 7.5 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows… |
CVE-2026-2056 | Medium | 5.3 | 2026-02-06 | A security vulnerability has been detected in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The impacted element is an unknown function of the file /wan_connec… |
CVE-2026-2055 | Medium | 5.3 | 2026-02-06 | A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Inform… |
CVE-2026-2054 | Medium | 5.3 | 2026-02-06 | A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. Impacted is an unknown function of the component Wifi Setting Handler. Per… |
CVE-2026-2009 | Medium | 6.3 | 2026-02-06 | A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser… |
CVE-2026-24302 | High | 8.6 | 2026-02-05 | Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-24300 | Critical | 9.8 | 2026-02-05 | Azure Front Door Elevation of Privilege Vulnerability |
CVE-2026-1964 | Medium | 4.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipula… |
CVE-2026-1963 | Medium | 6.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The mani… |
CVE-2026-1962 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Atta… |
CVE-2026-1707 | High | 7.4 | 2026-02-05 | pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing rest… |
CVE-2025-68721 | High | 8.1 | 2026-02-05 | Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions… |
CVE-2026-1898 | Medium | 6.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User… |
CVE-2026-1896 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/co… |
CVE-2026-1895 | Medium | 6.3 | 2026-02-04 | A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Exec… |
CVE-2026-25519 | High | 8.1 | 2026-02-04 | OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2… |
CVE-2025-70997 | Medium | 6.5 | 2026-02-04 | A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level. |
CVE-2026-1813 | Medium | 6.3 | 2026-02-04 | A vulnerability was found in bolo-blog bolo-solo up to 2.6.4. Affected is an unknown function of the file src/main/java/org/b3log/solo/bolo/pic/PicUploadProces… |
CVE-2026-24670 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability a… |
CVE-2026-24668 | Medium | 6.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability a… |
CVE-2025-60865 | High | 7.8 | 2026-02-03 | Insecure Permissions vulnerability in avanquest Driver Updater v.9.1.57803.1174 allows a local attacker to escalate privileges via the Driver Updater Service w… |
CVE-2020-37116 | High | 8.8 | 2026-02-03 | GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmi… |
CVE-2025-6592 | | 2026-02-02 | Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects Abuse… | |
CVE-2026-1117 | High | 8.2 | 2026-02-02 | A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. Th… |
CVE-2026-1742 | Medium | 4.7 | 2026-02-02 | A vulnerability was identified in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro… |
CVE-2026-24904 | Medium | 5.3 | 2026-01-29 | TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`, `TlsListener::listen()` peeks 1024 byte… |
CVE-2025-7016 | High | 8.0 | 2026-01-29 | Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects… |
CVE-2025-46691 | High | 7.8 | 2026-01-28 | Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access c… |
CVE-2026-0844 | High | 8.8 | 2026-01-28 | The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction o… |
CVE-2025-67645 | High | 8.8 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control i… |
CVE-2026-24740 | Critical | 9.9 | 2026-01-27 | Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by labe… |
CVE-2026-24473 | Medium | 5.3 | 2026-01-27 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Worke… |
CVE-2026-1445 | Medium | 4.7 | 2026-01-26 | A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability affects unknown code of the file contr… |
CVE-2025-70982 | Critical | 9.9 | 2026-01-26 | Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data. |
CVE-2026-1424 | Medium | 4.7 | 2026-01-26 | A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unre… |
CVE-2026-1423 | Medium | 6.3 | 2026-01-26 | A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php… |
CVE-2026-1411 | Medium | 6.1 | 2026-01-26 | A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55. The affected element is an unknown function of the component UART Interface. This manipulati… |
CVE-2026-1407 | Low | 2.0 | 2026-01-25 | A security flaw has been discovered in Beetel 777VR1 up to 01.00.09/01.00.09_55. This affects an unknown part of the component UART Interface. Performing a man… |
CVE-2026-24420 | Medium | 6.5 | 2026-01-24 | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attac… |
CVE-2025-70986 | High | 7.5 | 2026-01-23 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data. |
CVE-2025-70985 | Critical | 9.1 | 2026-01-23 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope. |
CVE-2025-70983 | Critical | 9.9 | 2026-01-23 | Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to escalate privileges. |
CVE-2025-69908 | High | 7.5 | 2026-01-23 | An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible cl… |
CVE-2025-69907 | High | 7.5 | 2026-01-23 | An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCa… |
CVE-2026-24304 | Critical | 9.9 | 2026-01-23 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-24306 | Critical | 9.8 | 2026-01-22 | Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-20912 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be… |
CVE-2026-20904 | Medium | 6.5 | 2026-01-22 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other us… |
CVE-2026-20897 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks b… |
CVE-2026-20888 | Medium | 4.3 | 2026-01-22 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able t… |
CVE-2026-20883 | Medium | 6.5 | 2026-01-22 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue t… |
CVE-2026-20750 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modi… |
CVE-2026-20736 | High | 7.5 | 2026-01-22 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete… |
CVE-2026-0798 | Low | 3.5 | 2026-01-22 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private… |
CVE-2025-69822 | High | 7.4 | 2026-01-22 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafte… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2026-24055 | Medium | 5.3 | 2026-01-22 | Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAu… |
CVE-2026-24039 | Medium | 4.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). Version 1.4.0 has Improper Access Control, allowing low-privileged employees to self… |
CVE-2026-24036 | Medium | 5.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/re… |
CVE-2026-24035 | Medium | 4.3 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in v… |
CVE-2025-14083 | Low | 2.7 | 2026-01-21 | A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or… |
CVE-2026-21984 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21982 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Diff… |
CVE-2026-21962 | Critical | 10.0 | 2026-01-20 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for… |
CVE-2026-21961 | Medium | 6.1 | 2026-01-20 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Company Dir / Org Chart Viewer, Employee Snapshot). T… |
CVE-2026-21960 | Medium | 6.5 | 2026-01-20 | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-21959 | Medium | 4.9 | 2026-01-20 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-21636 | Critical | 10.0 | 2026-01-20 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `-… |
CVE-2025-14977 | High | 8.1 | 2026-01-20 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-1197 | Low | 3.1 | 2026-01-20 | A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadById. Performing a ma… |
CVE-2026-1196 | Low | 3.1 | 2026-01-20 | A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the… |
CVE-2026-1194 | Medium | 5.3 | 2026-01-20 | A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information di… |
CVE-2026-23877 | Medium | 4.3 | 2026-01-19 | Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` e… |
CVE-2026-1170 | Medium | 5.3 | 2026-01-19 | A vulnerability was detected in birkir prime up to 0.4.0.beta.0. This issue affects some unknown processing of the file /graphql of the component GraphQL API… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2026-1181 | Critical | 9.0 | 2026-01-19 | Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin req… |
CVE-2026-1152 | Medium | 4.7 | 2026-01-19 | A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Hand… |
CVE-2026-1126 | Medium | 6.3 | 2026-01-18 | A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \flow-m… |
CVE-2026-1107 | Medium | 6.3 | 2026-01-18 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handl… |
CVE-2026-1061 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller… |
CVE-2025-31186 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences. |
CVE-2025-24090 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2024-54556 | Low | 2.4 | 2026-01-16 | This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from… |
CVE-2024-44210 | Low | 3.3 | 2026-01-16 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2026-1009 | Critical | 9.0 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authentica… |
CVE-2026-23496 | Medium | 5.4 | 2026-01-15 | Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side… |
CVE-2026-23495 | Medium | 4.3 | 2026-01-15 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore… |
CVE-2026-23494 | Medium | 4.3 | 2026-01-15 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization… |
CVE-2025-64516 | High | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (tick… |
CVE-2025-61973 | High | 8.8 | 2026-01-15 | A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL f… |
CVE-2026-22909 | High | 7.5 | 2026-01-15 | Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupt… |
CVE-2026-21889 | High | 7.5 | 2026-01-14 | Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This co… |
CVE-2025-14338 | | 2026-01-14 | Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as i… | |
CVE-2025-68949 | Medium | 5.3 | 2026-01-13 | n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching i… |
CVE-2026-20949 | High | 7.8 | 2026-01-13 | Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-20929 | High | 7.5 | 2026-01-13 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. |
CVE-2026-20843 | High | 7.8 | 2026-01-13 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-20839 | Medium | 5.5 | 2026-01-13 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally. |