Improper Access Control · Common Weaknesses

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Access Control CWE-284 CWE-284 at MITRE

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Incorrect Authorization CWE-863 6 (60.0%) Authorization Bypass Through User-Controlled Key CWE-639 2 (20.0%) Improper Authorization CWE-285 1 (10.0%) Missing Authorization CWE-862 1 (10.0%) Improper Authentication CWE-287 0 (0.0%) Authentication Bypass Using an Alternate Path or Channel CWE-288 0 (0.0%)

CVEs

CVEs for Improper Access Control CWE-284

Summary	Publication	CVE ID	Published
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding	`pkg:hex/grpc` `pkg:github/elixir-grpc/grpc`	CVE-2026-48599	2026-06-15
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist	`pkg:otp/ssl` `pkg:github/erlang/otp`	CVE-2026-48860	2026-06-10
Missing authorization check on save-job event handler in oban_web	`pkg:hex/oban_web` `pkg:github/oban-bg/oban_web`	CVE-2026-48592	2026-05-26
Cross-session PubSub topic injection via URL parameter in phoenix_storybook	`pkg:hex/phoenix_storybook` `pkg:github/phenixdigital/phoenix_storybook`	CVE-2026-47068	2026-05-20
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)	`pkg:otp/inets` `pkg:github/erlang/otp`	CVE-2026-28808	2026-04-07
Improper authorization in device bulk actions and device update API allows cross-organization device control	`pkg:otp/nerves_hub` `pkg:oci/nerves-hub` `pkg:github/nerves-hub/nerves_hub_web`	CVE-2026-28806	2026-03-10
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access	`pkg:github/hexpm/hexpm`	CVE-2026-21621	2026-03-05
Authorization bypass when bypass policy condition evaluates to true	`pkg:hex/ash` `pkg:github/ash-project/ash`	CVE-2025-48044	2025-10-17
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization	`pkg:hex/ash` `pkg:github/ash-project/ash`	CVE-2025-48043	2025-10-10
Before action hooks may execute in certain scenarios despite a request being forbidden	`pkg:hex/ash` `pkg:github/ash-project/ash`	CVE-2025-48042	2025-09-07

10 CVEs