CWE-284: Improper Access Control vulnerabilities

Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS. Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.

Langfuse versions from 3.68.0 up to but not including 3.167.0 contain a role-based access control vulnerability in the LLM connection update flow. A user with the 'member' role in a project could update an LLM connection to redirect test requests to an attacker-controlled URL, causing exposure of the plaintext provider LLM API key. This flaw has been fixed in version 3.167.0.

A path traversal vulnerability (CWE-22) in Dapr versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5 allows bypassing access control policies for service invocation. The issue arises because the ACL normalized the method path separately from the dispatch layer, causing a mismatch that lets attackers use reserved URL characters and path traversal sequences to access unauthorized services. This vulnerability has been fixed in versions 1.15.14, 1.16.14, and 1.17.5.

PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

CVE-2026-42278 is a high-severity improper access control vulnerability in the UltraDAGcom core blockchain software. The flaw exists in the StateEngine implementation of SmartTransferTx prior to commit fb6ef59, where transactions originating from "Pocket" sub-addresses bypass spending policy checks. This allows an attacker with access to a parent account key to drain all funds from associated pockets, ignoring configured vault delays or daily limits. The issue has been patched in commit fb6ef59. No known exploits in the wild have been reported.

CVE-2026-41900 is a high-severity vulnerability in the OpenLearnX platform prior to version 2.0.3. It involves improper neutralization of special elements in OS commands, leading to remote code execution and sandbox escape in the code execution environment. This allows an attacker with limited privileges to execute arbitrary commands on the host system. The vulnerability has been patched in OpenLearnX version 2.0.3.

Nuclei versions from 3.0.0 up to but not including 3.8.0 contain an improper access control vulnerability in the JavaScript protocol runtime. This flaw allows JavaScript templates to bypass local file access restrictions and read local . js and . json files via the require() function. The vulnerability is addressed in version 3.8.

Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the sqlCollection:update endpoint due to missing validation of dangerous SQL keywords. This allows an attacker with collection management permissions to inject arbitrary SQL by first creating a benign SQL collection and then updating it to execute malicious SQL, potentially leading to data exfiltration. The vulnerability has been fixed in version 2.0.39.

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.