cve.bz

CWE-284: Improper Access Control, page 69

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-58525EPSS 0.5%

    Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

  2. 5.3CVE-2026-56217EPSS 0.3%

    Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly upda…

  3. 2.7CVE-2026-28378EPSS 0.2%

    The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

  4. 6.4CVE-2026-48958EPSS 0.5%

    An improper access check allows unauthorized users to create custom fields via webservices endpoints.

  5. 6.4CVE-2026-48957EPSS 0.4%

    An improper access check allows unauthorized users to access com_privacy datasets.

  6. 6.4CVE-2026-48956EPSS 0.3%

    An improper access check allows users to display a list of modules in the frontend.

  7. 6.4CVE-2026-48955EPSS 0.3%

    An improper access check allows unauthorized users to access workflow stage and transition information.

  8. 6.4CVE-2026-48948EPSS 0.4%

    An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

  9. 6.4CVE-2026-48947EPSS 0.3%

    An improper access check allows privileged users to overwrite media files without editing permissions.

  10. 6.3CVE-2026-54765EPSS 0.3%

    Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different ba…

  11. 9.8CVE-2026-48204EPSS 0.7%

    Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when t…

  12. 9.8CVE-2026-24014EPSS 0.7%

    Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an a…

  13. 6.9CVE-2026-14792EPSS 0.6%

    A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remot…

  14. 2.1CVE-2026-14777EPSS 0.4%

    A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /announcements.php. Executing a manipulation can lead to unrestricted upl…

  15. 2.1CVE-2026-14776EPSS 0.4%

    A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing…

  16. 2.1CVE-2026-14775EPSS 0.4%

    A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. T…

  17. 8.8CVE-2026-9085EPSS 0.1%

    Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Contro…

  18. 5.5CVE-2026-14736EPSS 0.5%

    A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack…

  19. 2.1CVE-2026-14698EPSS 0.4%

    A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the file upload_files.php. Performing a manipulation results in unrestricted upload. …

  20. 8.7CVE-2025-71380EPSS 0.6%

    The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially …

  21. 6.5CVE-2026-58523EPSS 0.9%

    Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

  22. 9.8CVE-2026-58422EPSS 0.4%

    Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

  23. 7.5CVE-2026-58421EPSS 0.4%

    Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

  24. 6.9CVE-2026-58286EPSS 0.4%

    Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  25. 6.9CVE-2026-58282EPSS 0.4%

    Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  26. 8.1CVE-2026-28699EPSS 0.6%

    Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

  27. 7.5CVE-2026-27779EPSS 0.6%

    Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.

  28. 7.5CVE-2026-27660EPSS 0.5%

    Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

  29. 9.8CVE-2026-26292EPSS 0.7%

    Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

  30. 9.1CVE-2026-26247EPSS 0.5%

    Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

  31. 7.5CVE-2026-25712EPSS 0.5%

    Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

  32. 7.5CVE-2026-24690EPSS 0.5%

    Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

  33. 7.5CVE-2026-24451EPSS 0.4%

    Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

  34. 8.1CVE-2026-22555EPSS 0.4%

    Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

  35. 5.3CVE-2026-20909EPSS 0.4%

    Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.

  36. 9.8CVE-2026-20896ExploitEPSS 2.8%

    Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

  37. 9.1CVE-2026-20706EPSS 0.6%

    Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

  38. 5.4CVE-2026-14614EPSS 0.3%

    A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients…

  39. 4.9CVE-2026-14613EPSS 0.4%

    A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an…

  40. 4.3CVE-2026-41123EPSS 0.3%

    Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access…

  41. 9.8CVE-2026-26145EPSS 0.7%

    Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.

  42. 8.1CVE-2026-55119EPSS 0.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.

  43. 8.3CVE-2026-55118EPSS 0.4%

    A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

  44. 9.8CVE-2026-55116EPSS 0.4%

    A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

  45. 8.8CVE-2026-55114EPSS 0.5%

    A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

  46. 8.8CVE-2026-55112EPSS 0.4%

    A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.

  47. 9.8CVE-2026-54408EPSS 0.6%

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.

  48. 8.6CVE-2026-54407EPSS 0.5%

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints.

  49. 9.1CVE-2026-54400EPSS 0.5%

    A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

  50. 10.0CVE-2026-50746EPSS 1.7%

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.