cve.bz

CWE-284: Improper Access Control, page 88

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.0CVE-2026-2666EPSS 0.4%

    A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestric…

  2. 2.1CVE-2026-2665EPSS 0.3%

    A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the file SysFileController.java of the component JSP Parser. Performing a manipulation of the argument…

  3. 8.8CVE-2025-70064EPSS 0.5%

    PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually …

  4. 4.3CVE-2023-38005EPSS 0.2%

    IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access controls.

  5. 8.8CVE-2026-23595EPSS 0.3%

    An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an atta…

  6. 7.7CVE-2026-2592EPSS 0.3%

    The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gatew…

  7. 8.9CVE-2026-2550EPSS 0.7%

    A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit…

  8. 5.5CVE-2026-2549EPSS 0.3%

    A vulnerability has been found in zhanghuanhao LibrarySystem 图书馆管理系统 up to 1.1.1. This impacts an unknown function of the file BookController.java. The manipulation leads to improper access controls. The attack is possible to be carried ou…

  9. 8.8CVE-2025-70866EPSS 0.5%

    LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin…

  10. 7.7CVE-2025-61879EPSS 0.3%

    In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism.

  11. 9.0CVE-2025-69634EPSS 0.2%

    Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur…

  12. 7.8CVE-2026-23856EPSS 0.1%

    Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an Improper Access Control vulnerability. A low privileged attacker with local access…

  13. 2.4CVE-2026-20642EPSS 0.2%

    An input validation issue was addressed. This issue is fixed in iOS 26.3 and iPadOS 26.3. A person with physical access to an iOS device may be able to access photos from the lock screen.

  14. 5.5CVE-2026-20638EPSS 0.2%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3. A user with Live Caller ID app extensions turned off could have identifying information leaked to the extensions.

  15. 7.1CVE-2026-20628EPSS 0.1%

    A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 2…

  16. 4.4CVE-2026-20603EPSS 0.2%

    This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Tahoe 26.3. An app with root privileges may be able to access private information.

  17. 3.3CVE-2026-20601EPSS 0.2%

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user permission.

  18. 7.5CVE-2026-2250EPSS 0.5%

    The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is conf…

  19. 9.8CVE-2025-8025EPSS 0.6%

    Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dinosoft ERP: from < 3.0.1…

  20. 6.9CVE-2025-29939EPSS 0.2%

    Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested paging (SNP) initialization, potentially resulting in a loss of guest memory con…

  21. 8.8CVE-2026-21255EPSS 0.4%

    Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.

  22. 7.8CVE-2026-21238EPSS 3.4%

    Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  23. 7.2CVE-2026-0653EPSS 0.4%

    On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited …

  24. 7.5CVE-2026-25231ExploitEPSS 1.7%

    FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this di…

  25. 2.0CVE-2026-2226EPSS 0.4%

    A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component ZIP File Handler. Such manipulation of the argument sql_filename leads to unrestricted upload. The …

  26. 2.0CVE-2026-2213EPSS 0.3%

    A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminAddAlbum.php. The manipulation of the argument txtimage results in unrestr…

  27. 5.3CVE-2026-2183EPSS 0.3%

    A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This affects an unknown part of the file /restructured/csv.php. The manipulation leads to unrestri…

  28. 5.5CVE-2026-2164EPSS 0.5%

    A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted…

  29. 5.5CVE-2026-2148EPSS 0.6%

    A security vulnerability has been detected in Tenda AC21 16.03.08.16. Affected is an unknown function of the file /cgi-bin/DownloadFlash of the component Web Management Interface. The manipulation leads to information disclosure. It is pos…

  30. 5.5CVE-2026-2147EPSS 0.6%

    A weakness has been identified in Tenda AC21 16.03.08.16. This impacts an unknown function of the file /cgi-bin/DownloadLog of the component Web Management Interface. Executing a manipulation can lead to information disclosure. The attack …

  31. 2.1CVE-2026-2146EPSS 0.3%

    A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument Fil…

  32. 5.5CVE-2026-2133EPSS 0.5%

    A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attac…

  33. 6.9CVE-2026-2207EPSS 0.4%

    A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information di…

  34. 5.3CVE-2026-2206EPSS 0.3%

    A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the component Administrative Repair Handler. Performing a manipulation results in improper …

  35. 5.3CVE-2026-2205EPSS 0.3%

    A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication Handler. Such manipulation leads to information disclosure. The attack may be per…

  36. 2.1CVE-2026-2075EPSS 0.3%

    A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\RoleController.…

  37. 7.7CVE-2026-25758EPSS 0.7%

    Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating …

  38. 5.5CVE-2026-2056EPSS 1.1%

    A security vulnerability has been detected in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The impacted element is an unknown function of the file /wan_connection_status.asp of the component DHCP Connection Status Handler. The manipulatio…

  39. 5.5CVE-2026-2055EPSS 1.1%

    A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Information Handler. Executing a manipulation can lead to information disclosure. The …

  40. 5.5CVE-2026-2054EPSS 1.1%

    A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. Impacted is an unknown function of the component Wifi Setting Handler. Performing a manipulation results in information disclosure. The attack may be init…

  41. 2.1CVE-2026-2009EPSS 0.3%

    A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser.php. Executing a manipulation can lead to improper access controls. It is possi…

  42. 9.8CVE-2026-24302EPSS 1.5%

    Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

  43. 9.8CVE-2026-24300EPSS 1.2%

    Azure Front Door Elevation of Privilege Vulnerability

  44. 5.3CVE-2026-1964EPSS 0.3%

    A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possi…

  45. 5.3CVE-2026-1963EPSS 0.4%

    A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotel…

  46. 5.3CVE-2026-1962EPSS 0.4%

    A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack…

  47. 6.3CVE-2026-1707EPSS 0.4%

    pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web in…

  48. 8.1CVE-2025-68721EPSS 0.3%

    Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certifi…

  49. 5.3CVE-2026-1898EPSS 0.3%

    A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initi…

  50. 5.3CVE-2026-1896EPSS 0.3%

    A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/comprehensiveBoardMigration.js of the component Migration Operation Handler. The m…