CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization5.3 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System Endpoint fetch_manager_details.php improper authorization6.9 Medium
- pamzey patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System checkin.php improper authorization5.3 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 com.dgen.alarm improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization4.8 Medium
- freedom factory dgen1Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorization4.8 Medium
- @powersync service-core, service-sync-rules, powersync-ja powersync-service +2 moreSome sync filters in PowerSync Service ignored using `config.edition: 3`6.5 Medium
- b3log siyuanSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage9.3 Critical
- wekanWekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens9.3 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +5 more +7 moreOrg.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)8.1 High
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation9.3 Critical
- kimaiKimai: API invoice endpoint missing customer-level access control (IDOR)6.5 Medium
- dani-garcia vaultwardenVaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role8.3 High
- openclawOpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP6.1 Medium
- openclawOpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist7.1 High
openclawnpmOpenClaw: Node exec approvals could be replayed across nodes6.9 Medium- openclawOpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains5.6 Medium
github.com/romitou/insatutoratGoINSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints8.7 High- google androidIn onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to...7.7 High
- psi-probe psi probepsi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of service5.3 Medium
- n8nn8n - SSO Enforcement Bypass via API6.0 Medium
- go2ismail free-crmgo2ismail Free-CRM Security API improper authorization5.3 Medium
- go2ismail asp.net-core-inventory-order-management-systemgo2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization5.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API5.4 Medium
- open-emr openemrOpenEMR Portal Users Can Forge Provider Signatures8.1 High
- feiyuchuixue sz-boot-parentfeiyuchuixue sz-boot-parent API Endpoint sys-message authorization6.9 Medium
- aliasvaultAliasVault App Backup aliasvault.xml backup2.0 Low
- funadminfunadmin Configuration Ajax.php setConfig improper authorization6.9 Medium
- feng ha ha ssm-erp, production ssm +1 morefeng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization5.3 Medium
- cradle e-commercedetronetdip E-commerce Product Management Update authorization5.3 Medium
- spipSPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure5.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.10 +3 more +5 moreOrg.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol3.8 Low
- themeatelier idonate – blood donation, request and donor management systemIDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function8.8 High
- cocoteanet cyreneadminCoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorization5.3 Medium
- googtech sms-ssmGoogTech sms-ssm API LoginInterceptor.java preHandle improper authorization5.3 Medium
- openclawOpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages8.2 High
- openclawOpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control6.3 Medium
- openclawOpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook8.2 High
- openclawOpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints8.3 High
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)9.4 Critical
- apple ipados, macos, safari +2 more +4 moreA logic issue was addressed with improved validation. This issue is fixed in iOS 18.7.5 and...3.3 Low
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...4.6 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- aiven klawKlaw has an improper authorisation check on /resetMemoryCache7.1 High
- cipplanner cipaceVulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before...7.5 High
- No product listedImproper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within...6.8 Medium
- Show moreLoading…