CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- decolua 9routerdecolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization5.3 Medium
- apache airflowApache Airflow: DAG authorization bypass on /ui/structure/structure_data3.1 Low
- sourcecodester water billing management systemSourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization6.9 Medium
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal4.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw evolution_handlers.go auth improper authorization5.3 Medium
- dolibarr erp crmDolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot fs.py _normalize_rw_path authorization5.3 Medium
- dolibarr erp crmDolibarr ERP CRM messaging.php authorization5.3 Medium
- eidetic-labs stigmemstigmem before 0.9.0a2 Authentication Bypass via Disabled Auth9.2 Critical
- freescout-help-desk freescoutFreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check4.3 Medium
- shopperdotcom shopperShopper: Authorization bypass and RBAC privilege escalation in team settings9.9 Critical
- macrozheng mallmacrozheng mall Super Admin Password update improper authorization5.1 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration2.0 Low
- openreplayCross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch5.3 Medium
- honoHono: JWT middleware accepts any Authorization scheme, not only Bearer4.8 Medium
- ibm db2IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query6.5 Medium
- No product listedSpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical...5.5 Medium
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7,...5.5 Medium
- e107inc e107e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()6.5 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorization5.3 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System grades.php improper authorization5.3 Medium
- sushmi-pal invoice-systemSushmi-pal Invoice-System Profile Workflow profile improper authorization5.3 Medium
- sushmi-pal invoice-systemSushmi-pal Invoice-System User Management user improper authorization5.3 Medium
- besen bs20 ev charging stationBesen BS20 EV Charging Station OTA Update Installation improper authorization9.2 Critical
- guizhou xiaoma technology jpressJPress UCenter Article Submission Endpoint doWriteSave improper authorization5.3 Medium
- quantumnous new-apiQuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization6.3 Medium
- dell unisphere for powermax, unisphere 360, unisphere for powermax virtual appliance +2 moreDell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass...6.5 Medium
- nocodbNocoDB: Shared-base link access can invite arbitrary users as persistent base members5.8 Medium
- authzed spicedbSpiceDB: Caveat structures with nested lists can result in improper cache reuse2.3 Low
- apache ofbizApache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs6.5 Medium
- shopperdotcom shopperShopper: Authorization bypass in multiple Livewire admin components8.1 High
edumfaPyPIeduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage7.1 High- wwbn avideoAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration5.3 Medium
- tencent weknoraTencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization5.3 Medium
- No product listedZ-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization5.3 Medium
- open5gsOpen5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Authenticated users can bypass model access control via exposed query parameter5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Missing authorization check at the model update function - models from other users can be updated6.5 Medium
- siyuan-note siyuanSiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs7.2 High
- siyuan-note siyuanSiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk4.3 Medium
- broadstreetads broadstreetBroadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation4.3 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Improper Authorization (CWE-285)4.3 Medium
- apache tomcatApache Tomcat: Security constraints not correctly applied9.1 Critical
- pocket-id pocket id, pocket-id +1 morePocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions8.5 High
- dani-garcia vaultwardenVaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization8.7 High
- industrial application software ias canias erpIndustrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization6.9 Medium
- No product listedJeecgBoot mLogin Endpoint LoginController.java authorization6.3 Medium
- external-secretsExternal Secrets Operator: Privilege escalation with secret overwriting4.9 Medium
- microsoft teamsMicrosoft Team Events Portal Information Disclosure Vulnerability9.6 Critical
- Show moreLoading…