CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- aegraAegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)8.6 High
- No product listedThe Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP...9.8 Critical
- No product listedThe Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android...8.8 High
- flowiseai flowiseFlowiseAI Flowise User Controller authorization5.3 Medium
- getgrav gravGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic8.1 High
- external-secretsExternal Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore5.3 Medium
- codecanyon perfex crmCodeCanyon Perfex CRM Tenant Clients.php project authorization5.3 Medium
- crocodilestick calibre-web-automatedcrocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization5.3 Medium
- janeczku calibre-webjaneczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization5.3 Medium
- toeverything affinetoeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization6.9 Medium
- jsbroks coco annotatorjsbroks COCO Annotator Dataset API datasets.py authorization6.9 Medium
- chatgptnextweb nextchatChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization6.9 Medium
- code-projects online hospital management systemcode-projects Online Hospital Management System Registration improper authorization5.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint5.3 Medium
- No product listedJeecgBoot FillRuleUtil edit improper authorization5.3 Medium
- owap defectdojoOWAP DefectDojo Benchmark/Engagement/Product/Survey authorization5.3 Medium
- nextlevelbuilder goclaw, goclaw lite +1 morenextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization6.9 Medium
- linkstackorg linkstackLinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization5.3 Medium
- themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fseOtter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie7.5 High
- No product listedo2oa NodeAgent NodeAgent.java syncFile improper authorization6.3 Medium
- agilonhealth minervaMultiple vulnerabilities in MphRx's Minerva8.5 High
- mettle sendportalmettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization5.3 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA update_passwd_process.php authorization5.3 Medium
wooeyPyPIWooey API Endpoint scripts.py add_or_update_script improper authorization5.3 Medium- code-projects invoice system in laravelcode-projects Invoice System in Laravel API Endpoint item improper authorization6.9 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization5.3 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel Profile profile improper authorization5.3 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel User Management user improper authorization5.3 Medium
- openclawOpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access6.0 Medium
- enchant97 note-markNote Mark: Unauthenticated read of notes and assets in soft-deleted public books5.3 Medium
- vanna-ai vannavanna-ai vanna Legacy Flask API improper authorization6.9 Medium
- almirhodzic nova-toggle-5nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields6.5 Medium
- No product listedA Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low...6.5 Medium
- oracle financial services analytical applications infrastructureVulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of...4.8 Medium
- oracle financial services customer screeningVulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial...7.5 High
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web...6.5 Medium
- usememos memosusememos UpdateInstanceSetting App.tsx memos_access_token improper authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI project.py get_projects_organisation authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI agent.py get_schedule_data authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization5.3 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog views.py form_valid improper authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization5.3 Medium
- collabora kodexplorerCollabora KodExplorer fileUpload Endpoint share.class.php improper authorization6.3 Medium
- collabora kodexplorerkodcloud KodExplorer systemRole.class.php roleGroupAction authorization5.3 Medium
- collabora kodexplorerkodcloud KodExplorer systemMember.class.php initInstall authorization5.1 Medium
- emq emqx enterpriseEMQ EMQX Enterprise Session Handling improper authorization5.3 Medium
@paperclipai/servernpmPaperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys9.9 Critical- Show moreLoading…