CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization6.9 Medium
- mjperpinosa stumasymjperpinosa stumasy Note Handler/Assignment notes authorization6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization5.3 Medium
- sourcecodester multi-vendor online grocery management systemSourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization5.3 Medium
- sourcecodester multi-vendor online grocery management systemSourceCodester Multi-Vendor Online Grocery Management System Users.php save_users improper authorization6.9 Medium
- gitea open source git serverPermanent Fork PR Workflow Approval Gate Bypass8.9 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.3 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability8.7 High
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization5.3 Medium
- froxlorFroxlor before 2.3.7 Authorization Bypass via Mysqls.add API5.3 Medium
- craftcms cmsCraft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap7.6 High
- surrealdbSurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted5.4 Medium
- surrealdbSurrealDB before 3.1.0 RELATE Statement Record Overwrite5.3 Medium
- cap-go capgoCapgo - Org/App Scope Mismatch in Device Creation Endpoint7.1 High
- cap-go capgoCapgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision7.2 High
- ibm langflow oss, langflow +1 moreUnauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass9.1 Critical
- @fastify/express, fastify fastify\/express +1 more@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins9.1 Critical
- apache activemqApache ActiveMQ: Authenticated web users retain admin access by default in the Web Console8.1 High
- apache tomcatApache Tomcat: Security constraints for default servlet ignored method6.5 Medium
- openidentityplatform openamOpenAM OAuth Authorization Bypass via PKCE Challenge9.1 Critical
- deepmyst mystiDeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization2.3 Low
- codeastro complaint management systemCodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization5.3 Medium
- cherryhq cherry-studioCherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization2.3 Low
- cherryhq cherry-studioCherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization6.3 Medium
- chess play and learn appChess Play and Learn App com.chess AndroidManifest.xml backup2.4 Low
- No product listedDatabend Tenant client_session_manager.rs state_key authorization5.3 Medium
- No product listedVoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization2.3 Low
- khoj-ai khojkhoj-ai khoj Conversation Sharing api_chat.py authorization5.1 Medium
- glpi-project glpiglpi-project glpi Document document.send.php canViewFile authorization6.3 Medium
- netflix lemurLemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR9.9 Critical
- linux, linux kernel +1 moreRDMA/core: Validate the passed in fops for ib_get_ucaps()8.8 High
- rocket.chatRocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation6.7 Medium
- openidentityplatform openamOpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints9.3 Critical
- cap-go capgoCap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass5.3 Medium
- cap-go capgoCapgo - Broken Object Level Authorization in Build Job Control via jobId Parameter7.2 High
- grokability snipe-itSnipe-IT: Improper Authorization in File Deletion (IDOR)5.4 Medium
- openidentityplatform openamOpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC8.5 High
- actualbudget actualActual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets4.3 Medium
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC6.9 Medium
- berriai litellmBerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization5.3 Medium
- berriai litellmBerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization5.3 Medium
- berriai litellmBerriAI litellm M2M JWT user_api_key_auth.py improper authorization2.3 Low
- berriai litellmBerriAI litellm Admin Key key_management_endpoints.py improper authorization5.3 Medium
- cap-go capgoCapgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys5.3 Medium
- liquidfilesLiquidfiles versions before 4.2.12 are affected by a broken access control vulnerability...5.9 Medium
- openbaoOpenBao's System Backend allows Unauthorized Management of the containing Namespace2.3 Low
- sentriz gonicSubsonic API: any authenticated user can delete or read any other user's playlist (IDOR)7.1 High
- linux, linux kernel +1 moreRDMA: During rereg_mr ensure that REREG_ACCESS is compatible7.8 High
- nl-portal nl-portal-backend-librariesNL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)6.5 Medium
- mervinpraison praisonaiPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API8.1 High
- Show moreLoading…