CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Yearly Trend
Top Affected Vendors
All Improper Access Control CVEs (1,300)
CVE-2021-41194 is an authentication bypass vulnerability in JupyterHub's FirstUseAuthenticator that allows unauthorized access to any user account whe...
Oct 28, 2021CVE-2021-20034 is an improper access control vulnerability in SonicWall SMA100 appliances that allows unauthenticated attackers to bypass path travers...
Sep 27, 2021This vulnerability allows unauthenticated remote attackers to read or write arbitrary files on Cisco APIC and Cloud APIC systems due to improper acces...
Aug 25, 2021CVE-2021-21399 is an authentication bypass vulnerability in Ampache's Subsonic API that allows unauthenticated attackers to access the application usi...
Apr 13, 2021This vulnerability allows remote attackers to access the Secomea SiteManager web UI from the internet using configured credentials due to improper acc...
Mar 5, 2021A Cross-Site Request Forgery (CSRF) vulnerability in Dolibarr ERP & CRM v22.0.9 allows remote attackers to escalate privileges by exploiting the notes...
Feb 12, 2026Altium 365 workspace endpoints have an overly permissive CORS policy that allows credentialed cross-origin requests from other Altium-controlled subdo...
Jan 19, 2026This vulnerability in Azure Bot Service allows attackers to escalate privileges within affected deployments, potentially gaining unauthorized access t...
Sep 4, 2025This vulnerability allows authenticated users on Azure Stack Hub to elevate their privileges beyond their assigned permissions. Attackers could gain a...
Sep 10, 2024This vulnerability allows an attacker with access to an Azure Kubernetes Service (AKS) confidential container to escalate privileges and potentially g...
Apr 9, 2024This vulnerability allows remote attackers to execute arbitrary code on Microsoft Azure Kubernetes Service (AKS) confidential container nodes. Attacke...
Feb 13, 2024CVE-2024-22206 is an authentication bypass vulnerability in Clerk's Next.js integration that allows unauthorized access or privilege escalation due to...
Jan 12, 2024This vulnerability allows an attacker who compromises a Universal Forwarder endpoint to deploy malicious forwarder bundles to all other Universal Forw...
Jun 15, 2022This vulnerability allows attackers to manipulate the remote address used for pulling patches in Bitdefender's patchesUpdate API on Linux systems conf...
Nov 24, 2021This authentication bypass vulnerability in the application API allows remote attackers to create unauthorized administrative accounts. Attackers can ...
Feb 17, 2026LavaLite CMS 10.1.0 has an access control vulnerability where authenticated users with low-level privileges can bypass role restrictions and access th...
Feb 13, 2026The Simple User Registration WordPress plugin allows authenticated attackers with minimal permissions (like subscribers) to escalate their privileges ...
Jan 28, 2026OpenEMR versions before 7.0.4 have a broken access control vulnerability in the Profile Edit endpoint. Authenticated normal users can modify request p...
Jan 28, 2026A local privilege escalation vulnerability exists in Epic Games Store installation via Microsoft Store where low-privilege users can replace DLL files...
Jan 15, 2026Authenticated users in Wekan versions up to 18.15 can modify their entire user document, including organization/team memberships and account status fi...
Dec 15, 2025This vulnerability in Ruoyi 4.8.1 allows attackers to escalate privileges by exploiting a flaw where the owning department has higher rights than the ...
Nov 26, 2025Primakon Pi Portal 1.0.18 has an insecure direct object reference vulnerability in its /api/v2/pp_users endpoint that allows any authenticated user to...
Nov 25, 2025CVE-2025-43515 is a critical vulnerability in Apple Compressor where unauthenticated attackers on the same network can execute arbitrary code on Compr...
Nov 13, 2025This vulnerability in Cisco Catalyst Center Virtual Appliance allows authenticated users with at least Observer role to elevate privileges to Administ...
Nov 13, 2025The SOCET GXP Job Service lacks authentication requirements, allowing unauthorized job submissions. Remote users can potentially submit jobs in certai...
Oct 27, 2025CVE-2025-52079 allows unauthenticated attackers to change the administrator password on D-Link DIR-820L routers via a crafted POST request to /get_set...
Oct 21, 2025This vulnerability allows attackers to bypass Chrome's site isolation security feature through a specially crafted HTML page. It affects Google Chrome...
Sep 10, 2025This vulnerability in jshERP v3.5 allows unauthorized attackers to modify supplier statuses under any account due to incorrect access control in RoleC...
Aug 21, 2025This vulnerability allows an authenticated attacker with existing SQL Server access to elevate privileges over the network, potentially gaining admini...
Aug 12, 2025This CVE describes a sandbox escape vulnerability in macOS that allows malicious applications to bypass Local Network access restrictions. An attacker...
Jul 30, 2025An access control vulnerability in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using M...
Jul 29, 2025An improper access control vulnerability in the MediaWiki Scribunto extension allows unauthorized users to execute functions that should be restricted...
Jul 3, 2025A misconfiguration vulnerability in IITB SSO v1.1.0 allows attackers to bypass access controls and retrieve sensitive application data. This affects a...
Jul 1, 2025CVE-2025-33073 is an improper access control vulnerability in Windows SMB that allows authenticated attackers to elevate privileges over a network. Th...
Jun 10, 2025This vulnerability allows attackers to bypass a previous security patch (CVE-2025-46566) in DataEase, enabling them to construct malicious JDBC statem...
Jun 3, 2025This vulnerability allows non-administrative users with both 'User Management' and 'User Group Management' permissions in Devolutions Server to escala...
May 30, 2025This privilege escalation vulnerability in Joplin server allows non-admin users to modify their own user accounts via the PATCH /api/users/:id endpoin...
Apr 30, 2025This vulnerability in RUoYi v4.8.0 allows remote attackers to escalate privileges by exploiting improper permission validation in the /edit/{dictId} e...
Apr 7, 2025This vulnerability allows attackers to escalate privileges by placing a crafted executable into scheduled tasks in Inova Logic CUSTOMER MONITOR v3.1.7...
Mar 13, 2025CVE-2025-25614 is an incorrect access control vulnerability in Unifiedtransform 2.0 that allows teachers to modify personal data of other teachers, le...
Mar 10, 2025This vulnerability in Extreme Networks XIQ-SE allows low-privileged users to access administrator passwords, potentially enabling privilege escalation...
Feb 27, 2025This vulnerability in Intel Graphics software allows authenticated local users to escalate privileges by bypassing access controls. It affects systems...
Feb 12, 2025This vulnerability in reNgine allows attackers with penetration_tester or auditor roles to delete all projects, leading to system takeover via redirec...
Feb 4, 2025A broken access control vulnerability in Geovision GV-ASWeb versions v6.1.0.0 and earlier allows low-privilege users to perform unauthorized actions. ...
Feb 3, 2025CVE-2024-23920 is a critical vulnerability in ChargePoint Home Flex charging stations that allows network-adjacent attackers to execute arbitrary code...
Jan 31, 2025This vulnerability allows attackers to elevate privileges in Active Directory Domain Services, potentially gaining unauthorized administrative access....
Jan 14, 2025This vulnerability allows authenticated attackers to bypass access controls in Azure SaaS Resources, potentially exposing sensitive data over the netw...
Jan 9, 2025This vulnerability allows a developer account on a Hive-enabled OpenShift Dedicated cluster to escalate privileges to cluster-admin level by executing...
Dec 31, 2024GLPI versions 9.1.0 through 10.0.16 contain an API vulnerability where authenticated technicians can escalate privileges to higher-level accounts. Thi...
Dec 11, 2024This vulnerability in GLPI allows authenticated users to take control of other user accounts with equal or lower privilege levels via API exploitation...
Dec 11, 2024About Improper Access Control (CWE-284)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Our database tracks 1,300 CVEs classified as CWE-284, with 214 rated critical and 551 rated high severity. The average CVSS score for Improper Access Control vulnerabilities is 7.2.
External reference: View CWE-284 on MITRE CWE →
Monitor Improper Access Control Vulnerabilities
Get alerted when new Improper Access Control CVEs affect your infrastructure.
Start Monitoring Free