CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server +2 moreMicrosoft SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreActive Directory Certificate Services Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows OLE Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreNetlogon RPC Elevation of Privilege Vulnerability7.8 High
- microsoft windows admin centerWindows Admin Center (WAC) Remote Code Execution Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows StateRepository API Server file Elevation of Privilege Vulnerability7.8 High
- poco-ai poco-clawpoco-ai poco-claw Workspace API workspace.py get_workspace_file authorization6.9 Medium
- kimaiKimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation5.3 Medium
- kimaiKimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility5.3 Medium
- kimaiKimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation5.3 Medium
- waooai waoowaoowaooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization6.3 Medium
- decidimDecidim: CSV census record endpoints improper authorization6.0 Medium
- No product listedMacCMS Pro Installation Index.php step5 authorization6.3 Medium
- leantimeLeantime API saveSetting improper authorization5.3 Medium
- leantimeLeantime JSON-RPC Endpoint addUser improper authorization5.3 Medium
- cap-go capgoCapgo - Cross-Organization Account Disruption via SSO Prelink Endpoint7.2 High
- cap-go capgoCapgo - RBAC Demotion Privilege Retention via Stale org_users.user_right7.2 High
- astrbotdevs astrbotAstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software audio.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software composeEmailAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software pci_dss_status.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software group.jsp improper authorization5.3 Medium
- cap-go capgoCapgo - Billing Authorization Bypass via Exhausted Usage Credits5.3 Medium
- gristlabs grist-coreGrist: Insufficient access control in the /forms endpoint exposes table metadata4.3 Medium
- eleveo call recording softwareEleveo Call Recording Software sendlogfile improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software statisticReportAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software LDAP User users_ldap.jsp improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software Group roleAddAction.do improper authorization5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software userAddAction.do improper authorization5.3 Medium
- sipeed picoclawSipeed PicoClaw MQTT Channel mqtt.go authorization5.3 Medium
- pimcorePimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation7.1 High
- forgekeep nebula-meshnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation3.1 Low
- mettle sendportalmettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization5.3 Medium
- enchant97 note-markNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark5.3 Medium
- nl-portal nl.nl-portal:besluiten, nl.nl-portal:documenten-api +1 moreNL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries6.5 Medium
- linuxfoundation nats-serverNATS Server: Subscribe Authz Bypass via Wildcard-Overlap6.5 Medium
- linuxfoundation nats-serverNATS Server: Queue Subscribe Authz Bypass6.5 Medium
- No product listedHarness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization5.3 Medium
- cap-go capgoCapgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()5.3 Medium
- cap-go capgoCapgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance7.2 High
- better-auth oauth-provider@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass5.3 Medium
- egroupwareRemote Code Execution Vulnerability in EGroupware8.7 High
- coollabsio coolifyCoolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers9.9 Critical
- coderCoder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator8.2 High
- coderCoder: User-admin role can reset owner account password7.2 High
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE's subkey rollback protection can be bypassed with older subkey versions5.5 Medium
- craft cmsCraft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization5.3 Medium
- craft cmsCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization5.3 Medium
- Show moreLoading…