CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Yearly Trend
Top Affected Vendors
All Improper Access Control CVEs (1,314)
An input validation vulnerability in iOS/iPadOS allows someone with physical access to a locked device to view photos from the lock screen. This affec...
Feb 11, 2026This vulnerability allows a user to view restricted content from the lock screen on Apple iOS and iPadOS devices due to improper state management. It ...
Jan 16, 2026This vulnerability allows attackers with physical access to a locked macOS device to access contacts from the lock screen. It affects macOS users runn...
Nov 4, 2025This CVE describes a lock screen notification vulnerability in iOS/iPadOS where an attacker with physical access can view notification contents that s...
Nov 4, 2025An improper access control vulnerability in Intel CIP software allows unprivileged software running with a privileged user to potentially expose data ...
Nov 11, 2025CVE-2025-32037 is an improper access control vulnerability in Intel PresentMon versions before 2.3.1 that allows a local attacker with privileged acce...
Nov 11, 2025This vulnerability in the Tassos Framework plugin for Joomla allows unauthorized access to internal framework functionality through AJAX requests. Att...
Feb 20, 2026This vulnerability in Wikimedia Foundation's AbuseFilter allows improper access control through the AuthManager.php component. It affects systems runn...
Feb 2, 2026A race condition in Polkit authorization checks before version 0.69.0 can allow privilege escalation when Polkit authentication is disabled by default...
Jan 14, 2026An uncontrolled resource consumption vulnerability in certain ASUS motherboards with Intel chipsets allows physical attackers to install malicious dev...
Dec 17, 2025CVE-2025-66509 is a critical vulnerability in LaraDashboard that allows attackers to redirect password reset tokens to attacker-controlled servers. Wh...
Dec 4, 2025OpenObserve versions before 0.16.0 have an access control vulnerability where organization invitation tokens never expire, remain valid after user rem...
Nov 29, 2025This vulnerability allows authenticated users with read-only API roles in Wazuh to retrieve agent enrollment credentials through the /utils/configurat...
Nov 21, 2025DX Unified Infrastructure Management (Nimsoft/UIM) has an improper ACL handling vulnerability in its robot controller component that allows remote att...
Oct 1, 2025About Improper Access Control (CWE-284)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Our database tracks 1,314 CVEs classified as CWE-284, with 218 rated critical and 559 rated high severity. The average CVSS score for Improper Access Control vulnerabilities is 7.2.
External reference: View CWE-284 on MITRE CWE →
Monitor Improper Access Control Vulnerabilities
Get alerted when new Improper Access Control CVEs affect your infrastructure.
Start Monitoring Free