CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- jeecg bootJeecgBoot list queryPageList improper authorization2.3 Low
- macrozheng mallmacrozheng mall Member Endpoint update improper authorization5.3 Medium
- getmaxun maxungetmaxun Authentication Endpoint auth.ts router.get improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall OrderController.java submitOrderPayment improper authorization5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall Balance MemberController.java deductBalance improper authorization5.3 Medium
- fastapi-users project fastapi users, fastapi-users +1 moreFastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO5.9 Medium
fastapi-ssoPyPIFastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation6.9 Medium- microsoft partner centerMicrosoft Partner Center Elevation of Privilege Vulnerability10.0 Critical
- campcodes advanced voting management systemCampcodes Advanced Voting Management System Password voters_edit.php improper authorization5.3 Medium
- claris filemaker serverAn authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator...5.4 Medium
- pimpmylog, potsky pimp my log +1 morePimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint9.3 Critical
- weblateWeblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)4.3 Medium
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...6.5 Medium
- apple macosA logic issue was addressed with improved file handling. This issue is fixed in macOS Sonoma 14.8...5.5 Medium
github.com/babylonlabs-io/finality-providerGoFinality Provider vulnerable to anti-slashing bypassing due to misconfiguration8.7 High- siemens sinec security monitorA vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The...8.4 High
- senior-walter online student clearance systemSourceCodester Online Student Clearance System Fee Table delete-fee.php improper authorization6.9 Medium
- garidium g-ffl cockpitg-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion5.3 Medium
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs <= 2.1.14 - Missing Authorization to Settings Update5.4 Medium
- aureus erpHimool ERP AdminActionViewSet update_account improper authorization5.3 Medium
- ketr jepaasketr JEPaaS load improper authorization5.3 Medium
- macrozheng mall-swarmmacrozheng mall-swarm delete improper authorization5.3 Medium
- smallstep certificatesImproper Authorization Check for SSH Certificate Revocation5.0 Medium
- terminalfourIn Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not...9.8 Critical
- getgrav gravGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions8.6 High
- orionsec orion-ops, orion ops +1 moreorionsec orion-ops User Profile UserController.java update improper authorization6.9 Medium
- orionsec orion-ops, orion ops +1 moreorionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization5.3 Medium
- nutzam nutzbootnutzam NutzBoot Transaction API EthModule.java improper authorization6.9 Medium
- orangehrmOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments5.3 Medium
- orangehrmOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate Attachments5.3 Medium
- hackerbay oneuptimeOneUptime Unauthorized User Creation via API8.8 High
- humhub cfilesCFiles Unauthorized Folder/ZIP Access in Public Spaces5.4 Medium
- primakon project contract managementThe Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary...8.8 High
- primakon project contract managementPrimakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when...9.8 Critical
- primakon project contract managementThe Primakon Pi Portal 1.0.18 /api/V2/pp_users?email endpoint is used for user data filtering but...8.8 High
- code-projects blog sitecode-projects Blog Site admin.php improper authorization5.3 Medium
- langfuseLangfuse SSO Account Takeover via CSRF or phishing attack6.5 Medium
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- openfga, openfga helm charts +1 moreOpenFGA Improper Policy Enforcement5.8 Medium
- microsoft dynamics omnichannel sdk storage containersDynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability8.8 High
- wbce cmsWBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)8.7 High
- lukevella ralllyRallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation8.1 High
- lukevella ralllyRallly Improper Authorization in Comment Endpoint Allows User Impersonation6.5 Medium
- lukevella ralllyRallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal7.1 High
- lukevella ralllyRallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants8.1 High
- lukevella ralllyRallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)9.1 Critical
- lukevella ralllyRallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)6.5 Medium
- lukevella ralllyRallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes6.5 Medium
- softaculous siteseo – seo simplifiedSiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure4.3 Medium
- softaculous siteseo – seo simplifiedSiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset5.3 Medium
- Show moreLoading…