CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- docmostDocmost's Public Share Search Exposes Metadata of Restricted Children4.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes6.5 Medium
- free5gcfree5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions8.7 High
- free5gcfree5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions8.7 High
- free5gc, free5gc webconsole +1 morefree5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions8.7 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +10 more +12 moreWindows Kerberos Elevation of Privilege Vulnerability8.0 High
- snipeitapp snipe-itAn improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0...6.5 Medium
- perfree go-fastdfs-webperfree go-fastdfs-web doInstall InstallController.java improper authorization6.9 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN has Force Friend Request Acceptance4.3 Medium
- lin-snow ech0Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement7.2 High
- b3log siyuanSiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API8.1 High
- chartbrewChartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`7.7 High
- canonical jujuJuju CloudSpec API could leak senstive information9.9 Critical
- No product listedJeecgBoot SysAnnouncementController improper authorization5.3 Medium
- decolua 9routerdecolua 9router Administrative API Endpoint api authorization6.9 Medium
- inventreeInvenTree Plugin Installation - Insufficient Permissions6.6 Medium
- inventreeInvenTree Affected by Privilege Escalation via API7.2 High
- monetrmonetr: Protected Transactions Deletable via PUT5.7 Medium
- saleorSaleor has Cross-Account Email Change via Unbound Confirmation Token5.9 Medium
- ci4-cms-erp ci4msCI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files6.7 Medium
- pyloadpyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions5.4 Medium
- orangehrmOrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion5.1 Medium
- openclawOpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints7.1 High
- polarlearnPolarLearn has a Server Action Admin Bypass in Account Management Actions8.8 High
- cyber-iii student-management-systemCyber-III Student-Management-System HTTP POST Request update.php improper authorization6.9 Medium
- dromara lamp-cloudDromara lamp-cloud DefUserController pageUser improper authorization5.3 Medium
- belden hirschmann industrial hivisionHirschmann Industrial HiVision Improper Authorization Privilege Escalation7.1 High
- openclawOpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch8.7 High
- microsoft azure kubernetes serviceMicrosoft Azure Kubernetes Service Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure ai foundryAzure AI Foundry Elevation of Privilege Vulnerability10.0 Critical
- signalk signal k server, signalk-server +1 moresignalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity9.4 Critical
- sourcecodester leave application systemSourceCodester Leave Application System User Information index.php authorization6.9 Medium
- automattic mongooseCesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization6.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI has Broken Access Control in Tool Valves7.7 High
- google chromeInappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote...6.5 Medium
- wwbn avideoAVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter4.3 Medium
- parse-community parse-serverParse Server: Streaming file download bypasses afterFind file trigger authorization8.2 High
- discourseDiscourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions6.3 Medium
- discourseDiscourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories6.3 Medium
- discourseDiscourse: Category group moderators can perform actions on topics in restricted categories without read access5.3 Medium
- floragunn search guard flx, search-guard flx +1 moreSome management operations on data streams are not properly restricted when user does not have the necessary privileges6.8 Medium
- woocommerce woopayments: integrated woocommerce paymentsWooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax6.5 Medium
- scitokens, scitokens library +1 moreSciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking8.1 High
- basercmsbaserCMS: Mail Form Acceptance Bypass via Public API5.3 Medium
- openclawOpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands5.3 Medium
- openclawOpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass6.9 Medium
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)7.8 High- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag8.0 High
- No product listedchatwoot Signup Endpoint login improper authorization6.9 Medium
- kovah linkaceLinkAce discloses private notesto unauthorized authenticated users via the web link detail page6.5 Medium
- Show moreLoading…