CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- 201206030 novel xxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization 5.3 Medium
- 201206030 novel xxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorization 6.9 Medium
- nasa-gcn gcn.nasa.gov nasa-gcn gcn.nasa.gov Email Notification email improper authorization 5.3 Medium
- kubeflow pipelines Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines 7.2 High
- tinyhumansai openhuman OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution 9.8 Critical
- tinyhumansai openhuman OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture 6.1 Medium
- agentscope-ai agentscope agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization 6.9 Medium
- 6amtech 6valley 6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization 6.9 Medium
- cisco ise passive identity connector, identity services engine software +1 more Cisco Identity Services Engine Authorization Bypass Vulnerability 5.3 Medium
- infiniflow ragflow InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization 5.3 Medium
- sanluan publiccms Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization 5.3 Medium
- No product listed Umami Record API Endpoint route.ts authorization 6.9 Medium
- node-opcua node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 9.1 Critical
- am system alo suite Inadequate authorization vulnerability in Alosuite’s user invitation functionality 8.6 High
- wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 more Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions 9.4 Critical
- sanluan publiccms Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization 5.3 Medium
- oray pugongying x5 pro Oray Pugongying X5 Pro API Authorization run_async_task improper authorization 9.4 Critical
- google android In multiple locations, there is a possible permission bypass due to a logic error in the code.... 5.5 Medium
- drupal field collection for drupal 7 Field Collection for Drupal 7 access bypass via missing parent entity access check 5.3 Medium
- shopperdotcom shopper Shopper: missing variant-delete authorization permits destructive single and bulk actions 8.1 High
- immich-app immich Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API 3.5 Low
- infonl dimpact-zaakafhandelcomponent ZAC: Missing per-zaaktype authorization on by-ID decision and process reads 6.5 Medium
- givanz vvveb Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft 9.0 Critical
- apple xcode An authorization issue was addressed with improved state management. This issue is fixed in Xcode... 3.3 Low
- ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities 6.5 Medium
- bmc it service management suite Improper Authorization in BMC ITSM SmartIT Change Approvals 5.3 Medium
- bmc it service management suite Improper Authorization in BMC ITSM SmartIT Attachments 5.3 Medium
- frangoteam A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version... 5.6 Medium
- frangoteam A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1... 9.8 Critical
- grafana enterprise, oss +1 more SSO settings authorization bypass 8.9 High
- misp misp-guard MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement 6.1 Medium
- esri arcgis server BUG-000182936 - ArcGIS Server has a security vulnerability. 5.3 Medium
- bdtask garage 24 garage management software Bdtask Garage 24 Garage Management Software Backend improper authorization 5.3 Medium
- deepseek harness DeepSeek Harness Browser Auth browser-auth.ts improper authorization 6.9 Medium
- iflytek astron-agent iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization 5.3 Medium
- No product listed JIZHICMS Front-end Order OrderController.php pay improper authorization 5.3 Medium
- grokability snipe-it Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback 9.2 Critical
- No product listed Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization 5.3 Medium
- the-40-thieves obsidian-tc obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP 7.1 High
- No product listed HarnessRouter Identity Mode app.py improper authorization 6.3 Medium
- dhikshitha29 insurance-management-system dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization 6.9 Medium
- dhikshitha29 insurance-management-system dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization 6.9 Medium
- apache software foundation brpc Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration 7.5 High
- ibm datastage on cloud pak for data DataStage on Cloud Pak for Data Improper Authorization 10.0 Critical
- oracle webcenter portal Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component:... 6.5 Medium
- oracle corporation solaris Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The... 2.5 Low
- oracle corporation solaris Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System)... 7.1 High
- espocrm EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization 5.3 Medium
- nerimity desktop Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme 5.3 Medium
- apple ipados, macos, ios and ipados +1 more +3 more An authorization issue was addressed with improved state management. This issue is fixed in iOS... 5.5 Medium
- Show olderLoading…