CWE-284: Improper Access Control vulnerabilities

Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally.

Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

CVE-2026-41985 is a use-after-free (UAF) vulnerability in the package management module of Huawei HarmonyOS version 6.1.0. It involves improper access control (CWE-284) and may impact service integrity if exploited. The vulnerability requires high privileges and user interaction, with a medium severity score of 5.1. No official patch or remediation guidance is currently available.

CVE-2026-41984 is a use-after-free (UAF) vulnerability in the package management module of Huawei HarmonyOS version 6.1.0. It involves improper access control (CWE-284) that may impact service integrity if successfully exploited. The vulnerability has a medium severity with a CVSS score of 5.2. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-41006 is a high severity vulnerability in Spring HATEOAS affecting versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3. The issue arises from the internal PropertyUtils.createObjectFromProperties method, which performs bean property binding via reflection without respecting Jackson access-control annotations. This improper access control can lead to denial of service impacts. No official patch or remediation guidance is currently available.

CVE-2026-41847 is a medium severity vulnerability in the Spring Framework's WebFlux Kotlin Router DSL that allows improper access control, potentially enabling security bypass. It affects Spring Framework versions from 5.3.0 through 5.3.48. There is currently no official patch or remediation guidance from the vendor. No known exploits are reported in the wild at this time.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side validation and authorization checks, an authenticated user can manipulate internal attributes of a chatflow and reassign it to another workspace. This allows cross-workspace resource reassignment and unauthorized modification of deployment and visibility settings. This issue has been patched in version 3.1.2.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.

FlowiseAI Flowise versions prior to 3.1.2 contain a mass assignment vulnerability in the variable update endpoint. Authenticated users can modify server-controlled properties such as workspaceId without proper authorization checks, allowing reassignment of variables to arbitrary workspaces. This can break tenant isolation in multi-workspace environments. The issue has been fixed in version 3.1.2.

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. If an installation of Open XDMoD includes the optional Job Performance (SUPReMM) module, an attacker could bypass intended data access restrictions and view other users' compute job efficiency metrics. All deployments of Open XDMoD prior to version 11.0.3 that contain the optional Job Performance (SUPReMM) module are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.

Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.

Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.

A critical vulnerability (CVE-2026-48907) in the Joomla Content Editor (JCE) extension for Joomla allows unauthenticated users to create new editor profiles. This flaw leads to the upload and execution of arbitrary PHP code, posing a severe risk to affected systems. The vulnerability affects versions from 1.0.0 up to and including 2.9.99.4. Exploitation requires no privileges or user interaction and has been observed in the wild. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 4.0 base score of 10.0, indicating maximum severity.

OpenAI Atlas versions before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com domains. A cross-site scripting vulnerability on forum.openai.com could exploit this exposure to access browser history and control tabs. Version 1.2025.288.15 restricts these APIs to *.chatgpt.com, mitigating the issue. Users should upgrade to this version or later to address the vulnerability.

CVE-2024-27891 is a medium severity vulnerability in Arista Networks EOS where ACL policies may not be enforced on egressing packets if MACsec and egress ACLs are configured on the same interfaces. This improper access control can cause packets to be incorrectly allowed or denied when leaving the affected ports.

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.