Improper Access Control · Common Weaknesses

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Access Control CWE-284 CWE-284 at MITRE

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Incorrect Authorization CWE-863 18 (64.3%) Authorization Bypass Through User-Controlled Key CWE-639 5 (17.9%) Improper Authentication CWE-287 2 (7.1%) Missing Authorization CWE-862 2 (7.1%) Improper Authorization CWE-285 1 (3.6%) Authentication Bypass Using an Alternate Path or Channel CWE-288 0 (0.0%)

Classified as CWE-284 itself, not a child weakness 1

CVEs

CVEs for Improper Access Control CWE-284

Summary	Publication	CVE ID	Published
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint	Hex / ash_authentication_oauth2_server GitHub / ash-project/ash_authentication_oauth2_server	CVE-2026-82758	2026-09-07
inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth	Erlang pkg:otp/inets GitHub / erlang/otp	CVE-2026-74994	2026-09-01
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor	Hex / ash GitHub / ash-project/ash	CVE-2026-82747	2026-09-01
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records	Hex / ash GitHub / ash-project/ash	CVE-2026-82749	2026-09-01
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another	Hex / ash GitHub / ash-project/ash	CVE-2026-82748	2026-09-01
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records	Hex / ash GitHub / ash-project/ash	CVE-2026-82746	2026-09-01
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness	Hex / ash GitHub / ash-project/ash	CVE-2026-82745	2026-09-01
Authorization-redacted field values disclosed through AshTypescript result normalization	Hex / ash_typescript GitHub / ash-project/ash_typescript	CVE-2026-82730	2026-09-01
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data	Hex / ash_phoenix GitHub / ash-project/ash_phoenix	CVE-2026-82725	2026-08-31
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain	Hex / ash_phoenix GitHub / ash-project/ash_phoenix	CVE-2026-82724	2026-08-31
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle	Hex / ash_admin GitHub / ash-project/ash_admin	CVE-2026-81853	2026-08-31
Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records	Hex / ash_ai GitHub / ash-project/ash_ai	CVE-2026-82564	2026-08-31
Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read	Hex / ash_graphql GitHub / ash-project/ash_graphql	CVE-2026-80223	2026-08-30
Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification	Hex / ash_graphql GitHub / ash-project/ash_graphql	CVE-2026-81643	2026-08-30
exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql	Hex / ash_sql GitHub / ash-project/ash_sql	CVE-2026-77454	2026-08-30
Same-named aggregates with differing filters are conflated in AshSql	Hex / ash_sql GitHub / ash-project/ash_sql	CVE-2026-81316	2026-08-30
Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql	Hex / ash_sql GitHub / ash-project/ash_sql	CVE-2026-81318	2026-08-30
Purpose-limited JWT accepted as full bearer authentication in AshAuthentication	Hex / ash_authentication GitHub / team-alembic/ash_authentication	CVE-2026-65633	2026-08-25
OAuth token exchange grants repository scopes for organizations the principal cannot access	GitHub / hexpm/hexpm	CVE-2026-75542	2026-08-24
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding	Hex / grpc GitHub / elixir-grpc/grpc	CVE-2026-48599	2026-06-15
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist	Erlang / ssl GitHub / erlang/otp	CVE-2026-48860	2026-06-10
Missing authorization check on save-job event handler in oban_web	Hex / oban_web GitHub / oban-bg/oban_web	CVE-2026-48592	2026-05-26
Cross-session PubSub topic injection via URL parameter in phoenix_storybook	Hex / phoenix_storybook GitHub / phenixdigital/phoenix_storybook	CVE-2026-47068	2026-05-20
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)	Erlang Erlang / inets GitHub / erlang/otp	CVE-2026-28808	2026-04-07
Improper authorization in device bulk actions and device update API allows cross-organization device control	Nerves Hub ghcr.io / nerves-hub/nerves-hub GitHub / nerves-hub/nerves_hub_web	CVE-2026-28806	2026-03-10

25 per page · 29 CVEs