Browse / Access Control

Access Control

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Access Control - Generic888
• Privilege Escalation464
• Improper Authorization55
• Client-Side Enforcement of Server-Side Security20
• Forced Browsing14
• Incorrect Authorization13
• Reliance on Untrusted Inputs in a Security Decision8
• Improper Privilege Management7
• Missing Authorization7
• Improper Handling of Insufficient Permissions or Privileges4
• Incorrect Permission Assignment for Critical Resource3
• Execution with Unnecessary Privileges3
• Improper Export of Android Application Components2
• Incorrect Privilege Assignment2
• Incorrect Default Permissions2
• Access Control Check Implemented After Asset is Accessed1
• Improper Preservation of Permissions1

Often found together with

• Information Disclosure209
• Misconfiguration200
• Authentication179
• Insecure Direct Object Reference104
• Cross-site Scripting72
• Code Execution70
• Cross-Site Request Forgery61

Most upvoted Access Control reports

AllValidInformativeN/ADuplicate

1. Arbitrary File Write as SYSTEM from unprivileged userInformativePrivilege Escalation · high · Valve
   $1,25071 votes
2. Privilege Escalation leads to Unauthorized Access to Private Conversations By any Regular user [Read , Edit and Delete]InformativePrivilege Escalation · critical · Dust
   62 votes
3. Private Emails of Moz Workers Leaked in Public fileInformativeImproper Access Control - Generic · Mozilla
   52 votes
4. Bypass comment restrictionInformativeImproper Access Control - Generic · medium · HackerOne
   48 votes
5. Removed Guest role user who dosent have access to private project in members able to view jobs InformativeImproper Authorization · GitLab
   38 votes
6. Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurlInformativeImproper Access Control - Generic · curl
   37 votes
7. WAF bypass and java script incomplete handling of Unicode characters might leads to dom-xssInformativeImproper Access Control - Generic · Doppler
   36 votes
8. Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG InvitationInformativeImproper Access Control - Generic · medium · HackerOne
   33 votes
9. Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program InformativeImproper Access Control - Generic · low · HackerOne
   32 votes
10. Incorrect Authorization leads to see other users Documents UploadedInformativeIncorrect Authorization · medium · Tennessee Valley Authority
    29 votes
11. Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operationInformativeClient-Side Enforcement of Server-Side Security · low · HackerOne
    29 votes
12. InvalidInformativeImproper Access Control - Generic · low · WakaTime
    26 votes
13. curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clearInformativeImproper Access Control - Generic · high · curl
    25 votes
14. Disavowed an email without any authenticationInformativeImproper Access Control - Generic · medium · Liberapay
    24 votes
15. Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipesInformativePrivilege Escalation · Node.js
    20 votes
16. Unauthorized accessInformativeImproper Access Control - Generic · medium · GitLab
    18 votes
17. DLL Hijacking in Burp Suite Pro 2.0.19 InstallerInformativePrivilege Escalation · medium · PortSwigger Web Security
    17 votes
18. Unauthenticated Access Control Bypass — Private WordPress Post Disclosure (Outdated WordPress 4.9.40)InformativeImproper Authorization · Tucows (VDP)
    16 votes
19. api keys leakedInformativeImproper Access Control - Generic · medium · Reddit
    16 votes
20. no_proxy IDN mismatch: Unicode hostnames bypass proxy exclusion listInformativeImproper Access Control - Generic · curl
    15 votes
21. Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurlInformativeImproper Authorization · low · curl
    15 votes
22. HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)InformativeImproper Handling of Insufficient Permissions or Privileges · medium · curl
    15 votes
23. libcurl Digest/NTLM authentication ignores an explicit Authorization headerInformativeIncorrect Authorization · medium · curl
    14 votes
24. Elevation of Privileges (EoP) vulnerabilities related to the some easy_options on WindowsInformativePrivilege Escalation · high · curl
    14 votes
25. Cross-origin resource sharing: arbitrary origin trusted on chatws25.stream.highwebmedia.comInformativeImproper Access Control - Generic · Chaturbate
    14 votes
26. Can view all username leaked in https://core.blockstack.orgInformativeImproper Access Control - Generic · Hiro
    14 votes
27. TELNET control and environment data bypass HTTPS-proxy TLSInformativeImproper Access Control - Generic · curl
    13 votes
28. [Android org.torproject.android] Possible to force list of bridgesInformativeForced Browsing · high · Tor
    13 votes
29. Container escape on public GitLab CI runnersInformativeImproper Access Control - Generic · high · GitLab
    12 votes
30. oauth misconfigration lead to account takeoverInformativeIncorrect Authorization · Reddit
    11 votes
31. CSV export/import functionality allows administrators to modify member and message content of a workspaceInformativePrivilege Escalation · Slack
    $25011 votes
32. 49: Cookie-jar save transfers group access to a different GIDInformativeImproper Preservation of Permissions · curl
    10 votes
33. Web cache deception attack - expose earning state informationInformativeImproper Access Control - Generic · low · Semrush
    10 votes
34. Direct URL access to PDF filesInformativeForced Browsing · medium · Stellar.org
    10 votes
35. Unexpected federated shares added via public linkInformativeImproper Access Control - Generic · medium · Nextcloud
    7 votes
36. Insecure Direct Object Reference on badoo.comInformativePrivilege Escalation · Bumble
    7 votes
37. Found Origin IP's lead to access to gitlabInformativeImproper Access Control - Generic · medium · GitLab
    6 votes
38. bypassing dashboard without account + Information disclosure trough websockets InformativeImproper Access Control - Generic · high · Nextcloud
    6 votes
39. Vulnerability in Private Data Endorsement Policy Management in Hyperledger Fabric 2.0InformativeImproper Access Control - Generic · Linux Foundation Decentralized Trust
    6 votes
40. No password confirmation on changing primary email addressInformativeImproper Access Control - Generic · Inflection
    6 votes
41. 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classificationInformativeImproper Access Control - Generic · curl
    5 votes
42. app.lemlist.com : Admin Panel AccessInformativeImproper Access Control - Generic · lemlist
    5 votes
43. Business/Functional logic bypass: Remove admins from admin group.InformativePrivilege Escalation · Nextcloud
    5 votes
44. S3 bucket Upload on studio.redditinc.com (s3-r-w.ap-east-1.amazonaws.com)InformativeImproper Access Control - Generic · low · Reddit
    4 votes
45. Account Confirmation bypass leads to acess some fucntionality InformativeImproper Access Control - Generic · medium · Acronis
    4 votes
46. Github repo's wiki publicly editableInformativeImproper Access Control - Generic · Paragon Initiative Enterprises
    4 votes
47. The “payload” Field of Transactions in a Block Reveals the Private Data to All Peers InformativeImproper Access Control - Generic · Linux Foundation Decentralized Trust
    3 votes
48. Cross-origin resource sharing misconfiguration (CORS)InformativeImproper Access Control - Generic · Brave Software
    3 votes
49. Vulnerabilities in Endorsement Mechanism of Private Data Related Transactions in Hyperledger Fabric 2.0InformativeImproper Access Control - Generic · Linux Foundation Decentralized Trust
    3 votes
50. curl overwrites local file with -J option if file non-readable, but file writable.InformativeImproper Handling of Insufficient Permissions or Privileges · medium · curl
    3 votes
51. Edit Policy restriction does not prevent comments.InformativeImproper Access Control - Generic · medium · Phabricator
    3 votes
52. Github wikis are editable by anyone https://github.com/paragonie/password_lock/wikiInformativeImproper Access Control - Generic · medium · Paragon Initiative Enterprises
    3 votes
53. Security issue: Github repo's wiki publicly editableInformativeImproper Access Control - Generic · Ian Dunn
    3 votes
54. Privilage escalation with malicious .npmrcInformativePrivilege Escalation · high · Node.js third-party modules
    3 votes
55. curl/libcurl 8.20.0 NOPROXY bypass via uppercase-hex IPv4 aliases leaks off-proxy Basic credentials to the configured proxyInformativeImproper Access Control - Generic · medium · curl
    2 votes
56. Trusted server shared secret stored unencrypted in the databaseInformativeImproper Access Control - Generic · low · Nextcloud
    2 votes
57. curl on Windows can be forced to execute code via OpenSSL environment variablesInformativePrivilege Escalation · high · curl
    2 votes
58. Administrators can add other administratorsInformativePrivilege Escalation · Concrete CMS
    2 votes
59. Missing Certificate Authority Authorization ruleInformativeImproper Access Control - Generic · Gratipay
    2 votes
60. The email API to test email-server settings is unlimited and can be used as a email bombInformativeImproper Access Control - Generic · medium · Nextcloud
    2 votes
61. Bypassing Email verification InformativeImproper Access Control - Generic · Vimeo
    2 votes
62. Kubelet follows symlinks as root in /var/log from the /logs server endpoint InformativePrivilege Escalation · medium · Kubernetes
    1 votes
63. Ubuntu 12.04 Privilege EscalationInformativePrivilege Escalation · Nextcloud