CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- polarlearnPolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats10.0 Critical
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Code Execution Allowed Without Assessment Active State Validation5.3 Medium
- wekanWeKan Custom Translation translationBody.js setCreateTranslation improper authorization5.3 Medium
- jsbroks coco annotatorjsbroks COCO Annotator Delete Category undo improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Department Management DeptController.java deleteDept improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse Role Management RoleController.java deleteRole improper authorization5.3 Medium
- yeqifu warehouseyeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization5.3 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code Has Permission Deny Bypass Through Symbolic Links2.3 Low
- portabilis i-educarPortabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization5.3 Medium
- publiccmsSanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization2.3 Low
- collaboraonline onlineCollabora Online vulnerable to Authorization Bypass5.3 Medium
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Admin JWT Minting10.0 Critical
- wekanWeKan REST API checklistItems.js Checklist REST Bleed improper authorization5.3 Medium
- wekanWeKan REST API boards.js setBoardOrgs improper authorization2.3 Low
- crmebZhong Bang CRMEB :uni tidyOrder improper authorization5.3 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software User Management user.php improper authorization5.3 Medium
- bdtask saleserpBdtask SalesERP Administrative Endpoint improper authorization5.3 Medium
- phpgurukul hospital management systemPHPGurukul Hospital Management System Admin Dashboard adminviews.py improper authorization5.3 Medium
- linuxfoundation podman desktop, podman-desktop +1 morePodman Desktop Extension System Vulnerable to Authentication Bypass8.8 High
- dormakaba access manager 92xx-k5Unauthenticated Access to the SQLite Database in dormakaba access manager5.9 Medium
- phpmyfaqphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user6.5 Medium
- microsoft entra id, entra +1 moreAzure Entra ID Elevation of Privilege Vulnerability9.3 Critical
- apache solrApache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin8.2 High
- wukongopensource wukongcrm, 5kcrm wukong crm +1 moreWuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization5.3 Medium
- aquaplatform revive adserver, revive adserver +1 moreHackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass...7.1 High
- wedevs wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerceweMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure5.3 Medium
- mineadminMineAdmin View view improper authorization5.3 Medium
- phpgurukul news portalPHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization5.3 Medium
- publiccmsSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization5.3 Medium
- chamilo lmsChamilo LMS Legal Consent SocialController.php deleteLegal improper authorization5.3 Medium
- microsoft power apps, power apps desktop client +1 morePowerApps Desktop Client Remote Code Execution Vulnerability8.0 High
- danny-avila librechatLibreChat MCP Stdio Remote Command Execution9.1 Critical
- humansignal label studio, label-studio +1 moreLabel Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field8.6 High
- rustfsRustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation5.7 Medium
- rankology seo and analytics toolRankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation2.7 Low
- https://github.com/foobaroy/ foomuuriLack of client authorization allows arbitrary users to influence the firewall configuration5.1 Medium
- expresstech quiz and survey master (qsm) – easy quiz and survey maker, quiz and survey master +1 moreQuiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion4.3 Medium
- citeum openctiGraphQL IDOR allows authenticated user to delete workspace content of other users7.1 High
- yeqifu warehouseyeqifu warehouse Request UserController.java saveUserRole improper authorization5.3 Medium
- code-projects student file management systemcode-projects Student File Management System File Download download.php improper authorization5.3 Medium
- jeecg bootJeecgBoot getPositionUserList improper authorization2.3 Low
- jeecg bootJeecgBoot queryDepartPermission improper authorization2.3 Low
- jeecg bootJeecgBoot list getParameterMap improper authorization2.3 Low
- jeecg bootJeecgBoot datarule improper authorization2.3 Low
- jeecg bootJeecgBoot datarule loadDatarule improper authorization2.3 Low
- jeecg bootJeecgBoot getDeptRoleList improper authorization2.3 Low
- Show moreLoading…