cve.bz

CWE-284: Improper Access Control, page 49

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-74979EPSS 0.5%

    Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  2. 8.1CVE-2026-74960EPSS 0.2%

    Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  3. 7.5CVE-2026-74934EPSS 0.2%

    Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  4. 2.1CVE-2024-14046EPSS 0.4%

    A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Co…

  5. 9.8CVE-2026-42163EPSS 0.5%

    Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

  6. 9.8CVE-2026-68004EPSS 0.8%

    An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_…

  7. 1.3CVE-2026-19992EPSS 0.4%

    A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to inform…

  8. 9.3CVE-2026-73061EPSS 0.4%

    Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal,…

  9. 6.5CVE-2026-19711EPSS 0.3%

    The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payou…

  10. 2.1CVE-2026-19918EPSS 0.3%

    A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only b…

  11. 5.3CVE-2026-14229EPSS 0.3%

    The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpu…

  12. 5.1CVE-2026-71570EPSS 0.4%

    Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.

  13. 2.0CVE-2026-19839EPSS 0.4%

    A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remot…

  14. 2.0CVE-2026-19837EPSS 0.4%

    A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclos…

  15. 2.0CVE-2026-19835EPSS 0.5%

    A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can …

  16. 8.7CVE-2026-72837EPSS 0.6%

    File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belo…

  17. 8.6CVE-2026-73664EPSS 0.5%

    FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the aster…

  18. 4.3CVE-2026-59763EPSS 0.3%

    Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

  19. 9.1CVE-2026-58508EPSS 0.5%

    Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

  20. 5.3CVE-2026-58507EPSS 0.4%

    Private Repository Existence Disclosure via go-get Meta Endpoint

  21. 6.8CVE-2026-58440EPSS 0.5%

    Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

  22. 8.1CVE-2026-58439EPSS 0.5%

    Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

  23. 7.1CVE-2026-58437EPSS 0.3%

    Repository Visibility Manipulation via Git Push Options

  24. 4.9CVE-2026-58429EPSS 0.5%

    Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

  25. 4.4CVE-2026-58420EPSS 0.5%

    Local File Inclusion via file:// URI in Migration Restore

  26. 7.5CVE-2026-58417EPSS 0.5%

    REST API exposes organization membership of private organizations to public

  27. 6.2CVE-2026-56755EPSS 0.2%

    Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

  28. 9.1CVE-2026-56750EPSS 0.5%

    Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  29. 6.2CVE-2026-56657EPSS 0.2%

    Gitea SSH Key Parser Denial of Service

  30. 9.8CVE-2026-56654EPSS 0.8%

    Privilege Escalation via Access Token Scope Escalation in API

  31. 5.4CVE-2026-55986EPSS 0.3%

    Email Management API Bypasses ManageCredentials Feature Restrictions

  32. 2.7CVE-2026-55984EPSS 0.5%

    Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

  33. 7.7CVE-2026-73626EPSS 0.4%

    JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blockl…

  34. 8.6CVE-2026-59505EPSS 0.4%

    : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwal…

  35. 8.2CVE-2026-59501EPSS 0.3%

    : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwal…

  36. 5.3CVE-2026-13328EPSS 0.3%

    The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to…

  37. 7.8CVE-2026-13367EPSS 0.1%

    IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.

  38. 7.8CVE-2026-59917EPSS 0.1%

    Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation o…

  39. 7.8CVE-2026-59914EPSS 0.2%

    Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t…

  40. 6.3CVE-2026-67287EPSS 0.4%

    Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user s…

  41. 5.3CVE-2026-67284EPSS 0.4%

    Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned…

  42. 6.9CVE-2026-67283EPSS 0.4%

    Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on every fil…

  43. 9.1CVE-2026-16538EPSS 0.4%

    The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

  44. 4.3CVE-2026-14859EPSS 0.3%

    The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being gr…

  45. 8.2CVE-2026-13171EPSS 0.3%

    The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order r…

  46. 5.8CVE-2026-73212EPSS 0.5%

    Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and…

  47. 7.8CVE-2026-66804EPSS 0.3%

    Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-65773EPSS 0.3%

    Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

  49. 6.5CVE-2026-65675EPSS 0.6%

    No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.

  50. 8.5CVE-2026-20898EPSS 0.1%

    Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complex…