cve.bz

CWE-284: Improper Access Control, page 79

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.1CVE-2026-8545EPSS 0.2%

    Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

  2. 5.3CVE-2026-24711EPSS 0.2%

    Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.

  3. 7.5CVE-2026-44478EPSS 0.2%

    hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking onboardingCompleted and canReRunOnboarding before allowing…

  4. 8.1CVE-2026-33381EPSS 0.3%

    When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

  5. 7.1CVE-2026-33377EPSS 0.2%

    An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

  6. 4.3CVE-2026-28374EPSS 0.2%

    Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

  7. 9.1CVE-2026-44007EPSS 1.0%

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With…

  8. 6.8CVE-2026-36738EPSS 0.3%

    U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical acce…

  9. 5.3CVE-2026-44352EPSS 0.3%

    Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs from any user. This vulnerability is fixe…

  10. 5.3CVE-2026-44341EPSS 0.3%

    GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication a…

  11. 2.3CVE-2026-42158EPSS 0.2%

    Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investiga…

  12. 4.9CVE-2026-44874EPSS 0.3%

    A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability…

  13. 9.3CVE-2026-44225ExploitEPSS 1.5%

    Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() func…

  14. 9.8CVE-2026-44277EPSS 0.6%

    A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or comma…

  15. 5.5CVE-2026-42832EPSS 0.2%

    Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

  16. 9.9CVE-2026-42823EPSS 0.6%

    Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

  17. 5.3CVE-2026-42177EPSS 0.2%

    linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https:/…

  18. 6.2CVE-2026-41614EPSS 0.4%

    Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

  19. 5.5CVE-2026-41102EPSS 0.3%

    Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

  20. 5.5CVE-2026-41101EPSS 0.3%

    Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

  21. 4.4CVE-2026-41100EPSS 0.2%

    Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

  22. 8.8CVE-2026-41086EPSS 0.4%

    Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

  23. 8.8CVE-2026-40420EPSS 0.2%

    Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

  24. 7.8CVE-2026-40381EPSS 0.2%

    Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

  25. 7.8CVE-2026-33834EPSS 0.3%

    Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

  26. 4.4CVE-2026-32209EPSS 0.2%

    Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.

  27. 8.8CVE-2025-43524EPSS 0.1%

    An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app may be able to break out of its sandbox.

  28. 6.0CVE-2026-40300EPSS 0.2%

    Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text…

  29. 8.8CVE-2026-20887EPSS 0.5%

    Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may …

  30. 4.3CVE-2026-40020EPSS 0.3%

    Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to ot…

  31. 7.5CVE-2026-43652EPSS 0.2%

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data.

  32. 5.5CVE-2026-28993EPSS 0.1%

    This issue was addressed by adding an additional prompt for user consent. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may…

  33. 5.5CVE-2026-28988EPSS 0.1%

    A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An app may be able to bypass certain Privacy preferences.

  34. 8.8CVE-2026-28978EPSS 0.1%

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox.

  35. 7.5CVE-2026-28974EPSS 0.4%

    This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to cause a d…

  36. 7.5CVE-2026-28965EPSS 0.3%

    A privacy issue was addressed with improved checks. This issue is fixed in iOS 26.5 and iPadOS 26.5. A user may be able to view restricted content from the lock screen.

  37. 3.3CVE-2026-28957EPSS 0.1%

    An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen.

  38. 7.5CVE-2026-28930EPSS 0.3%

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.5. An app may be able to access protected user data.

  39. 6.5CVE-2026-28922EPSS 0.3%

    This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information.

  40. 3.3CVE-2026-28910EPSS 0.1%

    This issue was addressed with improved permissions checking. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files.

  41. 9.4CVE-2026-7813EPSS 0.5%

    Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's id…

  42. 7.2CVE-2025-9973EPSS 0.4%

    Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations. A malicious actor with privileges to co…

  43. 2.1CVE-2026-8233EPSS 0.2%

    A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The ex…

  44. 9.4CVE-2026-42569ExploitEPSS 1.2%

    phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

  45. 6.8CVE-2026-1749EPSS 0.3%

    There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.

  46. 8.8CVE-2026-42205EPSS 0.3%

    Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenti…

  47. 5.3CVE-2026-41487EPSS 0.2%

    Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An authenticated, low-privileged user of rol…

  48. 8.1CVE-2026-41491EPSS 0.3%

    Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found i…

  49. 8.5CVE-2026-8069EPSS 0.1%

    PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigure…

  50. 9.9CVE-2025-69691EPSS 0.7%

    Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.