CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- openbmb xagentOpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization2.3 Low
- franklioxygen mytubeMyTube has an Improper Access Control that Allows Complete Application Takeover7.4 High
- openclawOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat6.3 Medium
- openclawOpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action5.3 Medium
- openclawOpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist6.3 Medium
- openclawOpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch6.9 Medium
- grafana, grafana oss +1 moreMissing Protected-field Authorization in Provisioning Contact Points API5.4 Medium
- open-emr openemrOpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data7.7 High
- open-emr openemrOpenEMR has Improper ACL On Import/Export Popup5.4 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authentication issue was addressed with improved state management. This issue is fixed in iOS...7.5 High
- apple macosA privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Tahoe 26.4....5.5 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS...5.3 Medium
- linuxfoundation nats-serverNATS JetStream has an authorization bypass through its Management API4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions4.9 Medium
- go-vikunja vikunjaVikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation7.5 High
- go-vikunja vikunjaVikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect7.1 High
- sourcecodester patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorization6.9 Medium
- opensource-workshop connect-cmsConnect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information8.1 High
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export5.3 Medium
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulat…6.5 Medium
- No product listedMacCMS Member Order Detail User.php order_info authorization5.3 Medium
- mickasmt next-saas-stripe-startermickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization2.3 Low
- mickasmt next-saas-stripe-startermickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization5.3 Medium
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- bluewave-labs checkmateMass Assignment Privilege Escalation in Checkmate8.1 High
- discourseDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check5.3 Medium
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :path9.1 Critical
- blakeblackshear frigateFrigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts7.1 High
- canonical jujuUnauthorized update of out-of-scope Vault secrets7.6 High
- No product listedThe WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication...9.8 Critical
- citeum openctiOpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities6.5 Medium
- octopus serverIn affected versions of Octopus Server it was possible for a low privileged user to manipulate an...2.3 Low
- codegenieapp serverless-expressCodeGenieApp serverless-express API Endpoint TodoList.ts authorization5.3 Medium
- b3log siyuanSiYuan renderSprig: missing admin check allows any user to read full workspace DB6.5 Medium
- openclawOpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints8.7 High
- openclawOpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu6.9 Medium
github.com/centrifugal/centrifugoGo,github.com/centrifugal/centrifugo/v3Go,github.com/centrifugal/centrifugo/v4Go +2 more +4 moreCentrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning0.0 None- openclawOpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes9.2 Critical
- openclawOpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run5.3 Medium
- sourcecodester web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add_admin.php improper authorization5.3 Medium
- nerves-hub nerves hub web, nerveshub +1 moreImproper authorization in device bulk actions and device update API allows cross-organization device control9.4 Critical
- hackerbay oneuptimeOneUptime has WhatsApp Resend Verification Authorization Bypass5.3 Medium
- hackerbay oneuptimeOneUptime has authorization bypass via client‑controlled is-multi-tenant-query header10.0 Critical
- misskeyMisskey lacks proper authorization checks and input validation9.2 Critical
- pamzey patients waiting area queue management systemSourceCodester Patients Waiting Area Queue Management System patient-search.php improper authorization6.9 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System superadmin_user_update.php improper authorization6.9 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System Endpoint superadmin_delete_manager.php improper authorization6.9 Medium
- lerouxyxchire client database management systemSourceCodester Client Database Management System Endpoint superadmin_user_delete.php improper authorization5.3 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software Financial Report improper authorization5.3 Medium
- Show moreLoading…