What CVEs are caused by CWE-284?

3,865 recorded CVEs are attributed to CWE-284, including CVE-2026-48907, CVE-2026-34908, CVE-2025-12480. 33 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

What are the consequences of CWE-284?

Exploiting CWE-284 can lead to: Varies by Context.

Is CWE-284 actively exploited?

Yes. 33 CWE-284 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 3,865 recorded CVEs.

Pillar weakness

Incomplete

CWE-284: Improper Access Control

Also known as: Authorization

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Last updated May 1, 2026

3,865

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Pillar

Abstraction

MITRE classification

Overview

Access control involves the use of several protection mechanisms such as: Authentication (proving the identity of an actor) Authorization (ensuring that a given actor can access a resource), and Accountability (tracking of activities that were performed) When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator. Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.

Real-world CVEs

3,865 recorded CVEs are caused by CWE-284 (Improper Access Control), including 33 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 936 new CWE-284 CVEs have been recorded so far in 2026 (905 in 2025).

Showing 12 of 3,865 recorded CWE-284 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-284 vulnerabilities

Common consequences

What can happen when CWE-284 is exploited.

Varies by Context

Affects: Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Operation

Applies to

Technologies

ICS/OT (Often)

Web Based (Often)

How to prevent it

Practical mitigations for CWE-284, grouped by where in the lifecycle they apply.

Architecture and Design

Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design

Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

This code temporarily raises the program's privileges to allow creation of a new user folder.

Vulnerable example

python

def makeNewUserDir(username):

While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.

This function runs an arbitrary SQL query on a given database, returning the result of the query.

Vulnerable example

php

/.../
function runEmployeeQuery($dbName, $name){

While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

Multiple vendors did not use any authentication or used client-side authentication for critical functionality in their OT products.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2021-21972
CISA KEV
— Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
CVE-2021-37415
CISA KEV
— IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.
CVE-2020-13927
CISA KEV
— Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.
CVE-2023-26463 — Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)
CVE-2022-24985 — A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
CVE-2022-29238 — Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
CVE-2022-23607 — Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect
CVE-2021-35033 — Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port
CVE-2020-10263 — Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access
CVE-2010-4624 — Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.

Terminology & mappings

Alternate terms

Authorization: The terms "access control" and "authorization" are often used interchangeably, although many people have distinct definitions. The CWE usage of "access control" is intended as a general term for the various mechanisms that restrict which users can access which resources, and "authorization" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms.

Mapped taxonomies

PLOVER: Access Control List (ACL) errors
WASC: Insufficient Authorization (2)
7 Pernicious Kingdoms: Missing Access Control

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-284.

What is CWE-284?: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
What CVEs are caused by CWE-284?: 3,865 recorded CVEs are attributed to CWE-284, including CVE-2026-48907, CVE-2026-34908, CVE-2025-12480. 33 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
How do you prevent CWE-284?: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
What are the consequences of CWE-284?: Exploiting CWE-284 can lead to: Varies by Context.
Is CWE-284 actively exploited?: Yes. 33 CWE-284 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 3,865 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-284

Get alerted the moment a new CWE-284 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

Code examples

Illustrative examples

Related weaknesses

Child

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-284