CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System Reset Password Interface OperatorStop.asp improper authorization6.3 Medium
- psmplugins supportcandy – helpdesk & customer support ticket systemSupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference4.3 Medium
- fleetdm fleetSAML authentication vulnerability due to improper SAML response validation9.3 Critical
- wpswings wallet system for woocommerce, wallet system for woocommerce – digital wallet, buy now pay later (bnpl), instant cashback, referral program, partial & subscription payments +1 moreWallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization4.3 Medium
- qualcomm aqt1000 firmware, ar8031 firmware, ar8035 firmware +242 more +244 moreImproper Authorization in SPS-HLOS5.5 Medium
- zframeworks zzzj1983 zz improper authorization5.3 Medium
- frappe hrmspbrong hrms resource.go HrmsDB improper authorization6.9 Medium
- eastnets paymentsafeEastnets PaymentSafe URL Default.aspx improper authorization5.3 Medium
- joinmastodon mastodonMastodon's domain blocks & rationales ignore user approval when visibility set as "users"5.3 Medium
- acquia mautic, mautic mautic/core +1 moreImproper Authorization in Reporting API7.7 High
- glpi-project glpiGLPI: Plugins are disabled accessing one page6.9 Medium
- mayurik best employee management systemSourceCodester Best Employee Management System salary_slip.php authorization5.3 Medium
- ip2location country blockerIP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function7.5 High
- openfga, openfga helm charts +1 moreOpenFGA Authorization Bypass5.8 Medium
- eclipse foundation openvsx, eclipse open vsx +1 moreImproper Authorization in /user/namespace/{namespace}/details6.9 Medium
- wpswings return refund and exchange for woocommerceReturn Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference5.4 Medium
- r1bbit yimioaywoa setup.jsp improper authorization6.9 Medium
- wpbookingcalendar booking calendarWP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation5.3 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.0 High
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)9.1 Critical
- adobe commerce, commerce b2b +1 moreAdobe Commerce | Improper Authorization (CWE-285)8.1 High
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.2 High
- apphousekitchen aldente charge limiterAppHouseKitchen AlDente Charge Limiter XPC Service com.apphousekitchen.aldente-pro.helper shouldAcceptNewConnection improper authorization4.8 Medium
- huawei harmonyosPermission verification vulnerability in the media library module Impact: Successful exploitation...6.2 Medium
- edgelesssys contrastContrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery7.1 High
- cisco identity services engine, identity services engine software, ise passive identity connector +2 moreCisco Identity Services Engine Insufficient Authorization Bypass Vulnerability9.1 Critical
github.com/edgelesssys/marblerunGoMarbleRun unauthenticated recovery allows Coordinator impersonation7.1 HightshockNuGetTShock allows chat while not fully connected, possible ban evasion6.9 Medium- kubewarden kubewarden-controllerThe kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources6.5 Medium
- kubewarden kubewarden-controllerkubewarden-controller has an Information leak via AdmissionPolicyGroup Resource4.3 Medium
- aakashbhagat23 single-user-chat, aakashbhagat single user chat +1 moreSingle-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update8.1 High
- moreconvert woocommerce wishlist, wishlist for woocommerce +1 moreWooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function7.5 High
- campcodes school management softwareCampCodes School Management Software Staff edit-staff improper authorization5.3 Medium
- jenkins gitlab, jenkins project gitlab plugin +1 moreIncorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs4.3 Medium
- No product listedShiprocket Module REST API Module rest_api authorization6.3 Medium
- openobserveOpenObserve Improper Authorization Allows Admin User to Remove Root User8.7 High
- fanli2012 native-php-cmsFanli2012 native-php-cms Backend sysconfig_doedit.php improper authorization6.9 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 22h2 +13 more +15 moreWindows App Package Installer Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability7.2 High
- gradio-app gradioGradio Blocked Path ACL Bypass Vulnerability8.7 High
- openfga, openfga helm charts +1 moreOpenFGA Authorization Bypass5.8 Medium
- tgstation tgstation-servertgstation-server's role authorization incorrectly OR'd with user's enabled status8.8 High
- gocdGoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user9.4 Critical
- beijing yunfan internet technology yunfan learning examination systemBeijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization6.9 Medium
- pacovk tapirTapir allows DeployKey exposure8.7 High
- softiron hypercloudAuthenticated, non-admin users can create storage pools via the sifi API4.8 Medium
- teampassTeamPass mail_me operation authorization issue5.4 Medium
- teampassTeamPass does not properly check whether a folder is in a user's allowed folders list4.3 Medium
- huawei mate 20, p30, p30 pro +11 more +13 moreThere is an improper authorization vulnerability in some Huawei smartphones. An attacker could...3.5 Low
- citeum openctiOpenCTI leaks support information due to inadequate access control4.3 Medium
- Show moreLoading…