CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure6.5 Medium
- No product listedKazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.6.5 Medium
- zhuimengshaonian wisdom-educationzhuimengshaonian wisdom-education ExamInfoController.java selectStudentExamInfoList improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar periodo-lancamento improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar unificacao-aluno improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar consulta-dispensas improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar aluno improper authorization5.3 Medium
- code-projects employee management systemTutorials-Website Employee Management System HTTP Request all-applied-leave.php improper authorization6.9 Medium
github.com/kcp-dev/kcpGokcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace2.3 Low- roncoo roncoo-payroncoo roncoo-pay lookupList improper authorization6.9 Medium
- ruoyiyangzongzhuan RuoYi selectAll improper authorization5.3 Medium
- iocoder ruoyi-vue-proYunaiV ruoyi-vue-pro transfer improper authorization5.3 Medium
- iocoder yudao-cloudYunaiV yudao-cloud HTTP Request transfer improper authorization5.3 Medium
- jeecg bootJeecgBoot exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot Filter exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot deleteBatch improper authorization2.3 Low
- jeecg bootJeecgBoot getDepartUserList improper authorization2.3 Low
- sistemas pleno gestão de locaçãoSistemas Pleno Gestão de Locação CPF validarCpf authorization6.9 Medium
- langfuseImproper authorization in the background migration endpoints of Langfuse 3.1 before d67b317...7.6 High
- fuyang lipengjun platformfuyang_lipengjun platform queryAll SysSmsLogController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll TopicCategoryController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll TopicController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll UserCouponController improper authorization5.3 Medium
- 2wcom ip-4c firmwareThe 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain...6.8 Medium
- webkul qloappsWebkul QloApps CSRF Token authorization6.9 Medium
- bimser solution software trade inc. eba document and workflow management systemIDOR in Bimser's eBA Document and Workflow Management System6.4 Medium
- jeecg bootJeecgBoot sendMsg improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll BrandController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll AttributeController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll AttributeCategoryController improper authorization5.3 Medium
- patika global technologies humansuiteIDOR in Patika Global Technologies' HumanSuite6.5 Medium
- vmware spring frameworkCVE-2025-41249: Spring Framework Annotation Detection Vulnerability7.5 High
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8. An...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreAn authorization issue was addressed with improved state management. This issue is fixed in tvOS...9.8 Critical
- newbee-ltd newbee-mallnewbee-mall Order Status paySuccess improper authorization5.3 Medium
- crmebCRMEB UserAddressServices.php editAddress improper authorization5.3 Medium
- crmebCRMEB Administrator Password SystemAdminServices.php save improper authorization5.3 Medium
- ruoyiyangzongzhuan RuoYi Role cancelAll improper authorization5.3 Medium
- shenzhen sixun business management systemShenzhen Sixun Business Management System OperatorStop improper authorization6.9 Medium
- jeecg bootJeecgBoot Tenant Log Export exportLog improper authorization5.3 Medium
- jeecg bootJeecgBoot WebSocket Message sendWebSocketMsg improper authorization5.3 Medium
- linlinjava litemalllinlinjava litemall cancel WxAftersaleController improper authorization5.3 Medium
- iocoder ruoyi-vue-proYunaiV ruoyi-vue-pro transfer improper authorization5.3 Medium
- iocoder yudao-cloudYunaiV yudao-cloud submit improper authorization5.3 Medium
- iocoder ruoyi-vue-proYunaiV ruoyi-vue-pro transfer improper authorization5.3 Medium
- iocoder yudao-cloudYunaiV yudao-cloud transfer improper authorization5.3 Medium
- danny-avila danny-avila/librechat, librechat +1 moreImproper Authorization in danny-avila/librechat4.2 Medium
- papermerge dmsPapermerge DMS Authorization Token improper authorization5.3 Medium
- Show moreLoading…