CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- soumettre soumettre.frSoumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion3.7 Low
- graylog, graylog2 graylog2-server +1 moreGraylog vulnerable to privilege escalation through API tokens8.8 High
- juzaweb cmsjuzaweb CMS Add New Themes Page install improper authorization5.3 Medium
- juzaweb cmsjuzaweb CMS Import Page imports improper authorization5.3 Medium
- linlinjava litemalllinlinjava litemall post improper authorization5.3 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Authorization Bypass Vulnerability6.4 Medium
- mozilla firefoxThe prompt in Firefox for Android that asks before opening a link in an external application could be bypassed6.5 Medium
- 70mai 1s70mai 1S Configuration Config.cgi improper authorization5.3 Medium
- anthropics claude-codeClaude Code IDE extensions allow websocket connections from arbitrary origins8.8 High
- codeastro real estate management systemScriptAndTools Real Estate Management System User Delete userdelete.php authorization5.3 Medium
- szluyu99 gin-vue-blogszluyu99 gin-vue-blog PATCH Request manager.go improper authorization6.9 Medium
- salt project saltCVE-2025-22239 salt advisory8.1 High
- adobe experience managerAdobe Experience Manager | Improper Authorization (CWE-285)8.7 High
- elastic kibanaKibana Improper Authorization7.6 High
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Improper Authorization (CWE-285)8.2 High
- jack0240 魏 bskms 蓝天幼儿园管理系统jack0240 魏 bskms 蓝天幼儿园管理系统 User Creation addUser improper authorization6.9 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog photos improper authorization6.9 Medium
- unitybusinesstechnology the e-commerce erp: purchasing, inventory, fulfillment, manufacturing, bom, accounting, sales analysisProfitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint9.8 Critical
- offsprout page builderOffsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function8.8 High
- luminfire wp-geometaWP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function8.8 High
- summer pearl group vacation rental management platformSummer Pearl Group Vacation Rental Management Platform Listing authorization5.3 Medium
- erdogant pypickleerdogant pypickle pypickle.py save improper authorization4.8 Medium
- openfga, openfga helm charts +1 moreOpenFGA Authorization Bypass5.8 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right4.8 Medium
- ruoyiy_project RuoYi Offline Logout batchForceLogout improper authorization2.3 Low
- apache supersetApache Superset: Incorrect authorization leading to resource ownership takeover5.3 Medium
- m a vinoth kumar frontend dashboardFrontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function8.8 High
- m a vinoth kumar frontend dashboardFrontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function8.8 High
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An...7.1 High
- microsoft azure automationAzure Automation Elevation of Privilege Vulnerability9.9 Critical
- m a vinoth kumar frontend dashboardFrontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function9.8 Critical
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function8.2 High
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration5.3 Medium
github.com/inspektor-gadget/inspektor-gadgetGoInspektor Gadget Security Policies Can be Bypassed6.7 Medium- grafana, grafana enterprise +1 moreGrafana's datasource proxy API allows authorization checks to be bypassed5.0 Medium
- nootheme job listingsJob Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function9.8 Critical
- casdoorCasdoor SCIM User Creation Endpoint scim.go HandleScim authorization6.9 Medium
- google androidIn getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due...7.8 High
- macrozheng mallWeitong Mall Sale Endpoint improper authorization5.3 Medium
- microsoft azure ai bot serviceAzure AI Bot Elevation of Privilege Vulnerability9.8 Critical
- microsoft azure machine learningAzure ML Compute Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure ai bot serviceAzure Bot Framework SDK Elevation of Privilege Vulnerability8.7 High
- xwiki, xwiki xwiki-platform +1 moreThe lesscss script service allows cache clearing without programming right2.7 Low
- 201206030 novel-plus20120630 Novel-Plus LogController.java list improper authorization5.3 Medium
- 201206030 novel-plus20120630 Novel-Plus LogController.java deleteIndex improper authorization5.3 Medium
- wowjoy internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization5.3 Medium
- wowjoy internet doctor workstation systemwowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization5.3 Medium
- iteachyou dreamer cmsiteachyou Dreamer CMS Attachment download improper authorization5.3 Medium
- itwanger paicodingitwanger paicoding Article post improper authorization5.3 Medium
- gl.inet gl-a1300 slate plus, gl-ar300m shadow, gl-ar300m16 shadow +20 more +22 moreGL.iNet GL-A1300 Slate Plus Download Interface improper authorization5.1 Medium
- Show moreLoading…