cve.bz

CWE-284: Improper Access Control, page 71

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-31978EPSS 0.3%

    motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and movie API endpoints, suhc as /picture/{i…

  2. 7.1CVE-2026-27708EPSS 0.4%

    FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an order_id parameter and fetches the associated order without verifying the authent…

  3. 6.9CVE-2026-56302EPSS 0.3%

    Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delet…

  4. 7.1CVE-2026-56257EPSS 0.3%

    Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-brain ownership. Attackers can directly update apps.owner_org while leaving app_versions.owne…

  5. 6.9CVE-2026-47279EPSS 0.4%

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holdi…

  6. 6.0CVE-2026-54761EPSS 0.4%

    Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declar…

  7. 6.4CVE-2026-54015EPSS 0.3%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the prompt_id in the URL but then act on caller-supplied history IDs…

  8. 7.1CVE-2026-54012EPSS 0.3%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their mo…

  9. 8.3CVE-2026-54010EPSS 0.4%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether the…

  10. 7.5CVE-2026-52844EPSS 0.6%

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt o…

  11. 6.5CVE-2026-49411EPSS 0.2%

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A calle…

  12. 8.9CVE-2026-54305EPSS 0.4%

    n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope…

  13. 5.4CVE-2026-44958EPSS 0.3%

    An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overw…

  14. 4.3CVE-2026-44957EPSS 0.3%

    A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relation…

  15. 4.3CVE-2026-34913EPSS 0.3%

    A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers o…

  16. 4.3CVE-2026-34912EPSS 0.3%

    A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low‑privileged user could link their zones to banners or campaigns…

  17. 3.5CVE-2025-15619EPSS 0.2%

    HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.

  18. 8.1CVE-2026-28381EPSS 0.4%

    The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

  19. 8.7CVE-2026-56253EPSS 0.4%

    Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the pu…

  20. 7.1CVE-2026-12786EPSS 0.2%

    A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64.sys of the component Kernel Driver. The manipulation leads to improper access co…

  21. 7.1CVE-2026-12784EPSS 0.2%

    A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel Driver. This manipulation causes improper access controls. The attack requires …

  22. 7.1CVE-2026-12782EPSS 0.2%

    A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the component Kernel Driver. The manipulation results in improper access controls. The at…

  23. 7.1CVE-2026-12781EPSS 0.2%

    A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack ne…

  24. 7.1CVE-2026-12780EPSS 0.2%

    A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to b…

  25. 7.1CVE-2026-12779EPSS 0.2%

    A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library ddmdrv.sys of the component Kernel Driver. Performing a manipulation results in improper access controls. The …

  26. 7.1CVE-2026-12778EPSS 0.2%

    A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack mu…

  27. 8.7CVE-2026-56082EPSS 0.4%

    Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase pu…

  28. 7.1CVE-2026-4027EPSS 0.4%

    A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.

  29. 8.7CVE-2026-4026EPSS 0.4%

    A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings to escalate their privileges to Administrator level.

  30. 7.8CVE-2026-46461EPSS 0.1%

    Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

  31. 9.9CVE-2026-47647EPSS 0.8%

    Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

  32. 7.6CVE-2026-46699EPSS 0.3%

    conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended…

  33. 8.2CVE-2026-48617EPSS 0.3%

    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vul…

  34. 6.9CVE-2026-54533EPSS 0.3%

    vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms input and output files. Version 5.0.0 fixes the issue. As a workaround, verify …

  35. 6.9CVE-2026-12529EPSS 0.3%

    A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The man…

  36. 6.5CVE-2026-35162EPSS 0.2%

    Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

  37. 8.0CVE-2026-35067EPSS 0.1%

    Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileg…

  38. 7.1CVE-2026-35066EPSS 0.2%

    Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

  39. 8.8CVE-2025-66391EPSS 0.4%

    In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker att…

  40. 9.3CVE-2026-48616EPSS 0.3%

    Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l wi…

  41. 4.2CVE-2026-12460EPSS 0.2%

    Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity:…

  42. 6.5CVE-2026-46979EPSS 0.3%

    Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows high privilege…

  43. 10.0CVE-2026-46978EPSS 0.3%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access…

  44. 7.2CVE-2026-46976EPSS 0.3%

    Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attack…

  45. 7.5CVE-2026-46974EPSS 0.1%

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastru…

  46. 7.5CVE-2026-46971EPSS 0.2%

    Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker wi…

  47. 7.2CVE-2026-46969EPSS 0.5%

    Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker…

  48. 8.8CVE-2026-46967EPSS 0.4%

    Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privi…

  49. 7.5CVE-2026-46966EPSS 0.3%

    Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows l…

  50. 8.8CVE-2026-46965EPSS 0.4%

    Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low…