CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointbase +1 moreSteeltoe's sensitive actuators (heapdump/env) only require Restricted permission6.5 Medium
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Information Disclosure Vulnerability7.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletion7.1 High
- openclawOpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass6.3 Medium
- hcengineering huly platformhcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization5.3 Medium
- zongzhige shopxoShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization6.9 Medium
- genspark ai workspace appGenspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme4.8 Medium
- moovit bus & public transit appMoovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme4.8 Medium
- elated-themes frappeFrappe: IDOR in `submit_discussion()`6.9 Medium
- groww stock, mutual fund, gold appGroww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme1.0 Low
- l3montree-dev devguardDevGuard has improper authorization on public assets7.1 High
- apache ofbizApache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass8.8 High
- nezhahq nezhaNezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data5.3 Medium
github.com/dexidp/dexGoDex: Token-exchange endpoint is missing AllowedConnectors enforcement8.7 High- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.0 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Information Disclosure Vulnerability8.1 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +5 more +7 more.NET SDK Elevation of Privilege Vulnerability7.8 High
- microsoft powertoysMicrosoft PowerToys Elevation of Privilege Vulnerability7.8 High
- dolibarr erp crmDolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization5.3 Medium
- juev nebula-meshnebula-mesh: GET /api/v1/audit-log discloses all entries to any operator7.1 High
- tale headplaneHeadplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user8.1 High
- imvks786 student management systemimvks786 student_management_system Student Deletion Endpoint see.php improper authorization5.3 Medium
- bluditBludit CMS has improper authorization and mediation failure leading to persistent ghost sessions8.8 High
- mohammed-eid35 bank-management-system-springbootMohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization5.3 Medium
- sourcecodester inventory systemSourceCodester Inventory System Account Creation users_handler.php improper authorization5.3 Medium
github.com/weaviate/weaviateGo,govulncheck-vulndbopenSUSE +1 moreWeaviate Static API Key client.go validateConfig authorization2.3 Low- cyber-iii student-management-systemKushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization5.3 Medium
- chengdu everbrite network technology beikeshopChengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization5.3 Medium
- theonedev onedevtheonedev Pull Request issues canAccessIssue improper authorization5.3 Medium
- theonedev onedevtheonedev REST API default-branch improper authorization5.3 Medium
- theonedev onedevtheonedev Parent Project projects improper authorization5.3 Medium
- theonedev onedevtheonedev projects improper authorization5.3 Medium
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API9.8 Critical
- tittuvarghese collegemanagementsystemtittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization5.3 Medium
- sourcecodester ship ferry ticket reservation systemSourceCodester Ship Ferry Ticket Reservation System admin improper authorization5.3 Medium
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Information Disclosure Vulnerability9.1 Critical
- dfir-iris iris-webIris has an Improper Authorization issue7.1 High
- better-auth better auth, better-auth +1 moreBetter Auth: Device authorization approve and deny accept any authenticated session while the user code is pending7.6 High
- amauric tarteaucitron.jstarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies4.3 Medium
- sourcecodester online boat reservation systemSourceCodester Online Boat Reservation System Administrative Endpoint improper authorization5.3 Medium
- namelessmc namelessAuthenticated users can read hidden forum posts through `/forum/get_quotes`7.1 High
- apache kafkaApache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API4.3 Medium
- packagekitPackageKit API pk-transaction.c g_file_test improper authorization5.3 Medium
- devaslanphp project-managementDevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization5.3 Medium
- devaslanphp project-managementDevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization5.3 Medium
- bottelet daybydaycrmBottelet DaybydayCRM DocumentsController.php view improper authorization5.3 Medium
- google android xrIn addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a...10.0 Critical
- nextcloud approval, kiteworks security-advisories +1 moreNextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers6.5 Medium
- a4m4 student-management-systema4m4 Student-Management-System deleteform.php improper authorization6.9 Medium
- Show moreLoading…