cve.bz

CWE-284: Improper Access Control, page 68

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-55548EPSS 0.4%

    Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omit…

  2. 6.3CVE-2026-35148EPSS 0.3%

    HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs a…

  3. 8.1CVE-2026-1609EPSS 0.6%

    A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A r…

  4. 5.8CVE-2026-62314EPSS 0.3%

    Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Origi…

  5. 8.5CVE-2026-55234EPSS 0.4%

    Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do …

  6. 7.7CVE-2026-45313EPSS 0.2%

    Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGIS…

  7. 8.2CVE-2026-46485EPSS 0.4%

    Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality des…

  8. 9.8CVE-2026-14960EPSS 0.5%

    Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode call…

  9. 8.8CVE-2026-20150EPSS 0.4%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses …

  10. 7.7CVE-2026-47164EPSS 0.4%

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to…

  11. 6.5CVE-2026-36035EPSS 0.5%

    Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) via removing the…

  12. 8.8CVE-2026-47301EPSS 0.8%

    Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

  13. 9.8CVE-2026-58617EPSS 0.8%

    Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

  14. 5.5CVE-2026-58545EPSS 0.4%

    Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

  15. 7.8CVE-2026-57088EPSS 0.3%

    Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.

  16. 5.4CVE-2026-56157EPSS 0.5%

    Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  17. 5.5CVE-2026-50495EPSS 0.3%

    Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

  18. 7.1CVE-2026-50465EPSS 0.3%

    Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

  19. 7.8CVE-2026-50423EPSS 0.3%

    Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

  20. 6.1CVE-2026-50418EPSS 0.3%

    Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.

  21. 7.8CVE-2026-50373EPSS 0.3%

    Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

  22. 7.8CVE-2026-50335EPSS 0.3%

    Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

  23. 7.8CVE-2026-55014EPSS 0.3%

    Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.

  24. 7.8CVE-2026-50351EPSS 0.3%

    Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally.

  25. 8.8CVE-2026-50342EPSS 0.3%

    Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  26. 7.0CVE-2026-50325EPSS 0.2%

    Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

  27. 7.8CVE-2026-50311EPSS 0.3%

    Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.

  28. 7.0CVE-2026-50297EPSS 0.2%

    Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

  29. 7.0CVE-2026-49805EPSS 0.2%

    Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

  30. 5.5CVE-2026-15677EPSS 0.5%

    A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be e…

  31. 2.1CVE-2026-15627EPSS 0.4%

    A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information di…

  32. 8.7CVE-2026-57855EPSS 0.5%

    Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfol…

  33. 9.1CVE-2026-51538EPSS 0.5%

    EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided sessi…

  34. 2.0CVE-2026-15539EPSS 0.4%

    A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unres…

  35. 5.5CVE-2026-15530EPSS 0.5%

    A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to infor…

  36. 2.0CVE-2026-15518EPSS 0.4%

    A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert P…

  37. 5.5CVE-2026-15488EPSS 0.5%

    A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricte…

  38. 1.9CVE-2026-15476EPSS 0.1%

    A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The atta…

  39. 1.9CVE-2026-15475EPSS 0.1%

    A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Driver. This manipulation causes improper access controls. The at…

  40. 9.3CVE-2026-20744EPSS 0.8%

    The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

  41. 2.3CVE-2026-55670EPSS 0.4%

    ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in anot…

  42. 7.1CVE-2026-56335EPSS 0.4%

    Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability tri…

  43. 7.5CVE-2026-40452EPSS 0.4%

    Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 befor…

  44. 6.5CVE-2026-40009EPSS 0.4%

    Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache IoTDB: from 2.0.8 bef…

  45. 2.1CVE-2026-15329EPSS 0.4%

    A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in inform…

  46. 5.5CVE-2026-15319EPSS 0.5%

    A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_control.go of the component Launcher. Such manipulation leads to improper access con…

  47. 8.1CVE-2025-45422EPSS 0.4%

    Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules.

  48. 7.5CVE-2025-63579EPSS 0.3%

    Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypt…

  49. 7.5CVE-2026-59720EPSS 0.6%

    Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked …

  50. 2.1CVE-2026-15188EPSS 0.4%

    A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component …