CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- apache activemq, activemq all, activemq broker +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations6.5 Medium
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.6 and...5.5 Medium
- apple macos, safari +1 moreAn authorization issue was addressed with improved state management. This issue is fixed in...6.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...6.5 Medium
- unitedbyai droidclawunitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization2.3 Low
- astrbotdevs astrbotAstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot astr_main_agent.py authorization5.3 Medium
- nanocoai nanoclawnanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization5.3 Medium
- nanocoai nanoclawnanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization4.8 Medium
- openidentityplatform opendjOpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant9.6 Critical
- budibase serverBudibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF8.7 High
- microsoft azure portalAzure Portal Information Disclosure Vulnerability9.3 Critical
- microsoft azure red hat openshift (aro), azure red hat openshift +1 moreAzure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability9.1 Critical
- nextauthjs next-authNextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)9.1 Critical
- vercel next.jsNext.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale8.3 High
- oracle work in processVulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component:...5.4 Medium
- oracle e-business suite, oracle corporation contracts integration +1 moreVulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component:...6.1 Medium
- oracle corporation mysql connectors, oracle mysql connector\/j +1 moreVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...6.5 Medium
- oracle e-business suite, oracle corporation transportation execution +1 moreVulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite ...5.4 Medium
- oracle property managerVulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component:...5.4 Medium
- oracle work in processVulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component:...7.6 High
- oracle customer supportVulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component:...8.1 High
- oracle knowledge managementVulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component:...6.1 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...5.4 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...5.6 Medium
- solarwinds serv-uSolarWinds Serv-U Privilege Escalation Vulnerability9.1 Critical
- zsadmin2025 zs-adminzsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization5.3 Medium
- chamilo chamilo-lmsChamilo Authenticated Remote Code Execution7.5 High
- datacycle-engine datacycle-coreAPI Collection Impersonation Via user_email And Missing Object- Level Authorization8.1 High
- datacycle-engine datacycle-coredataCycle Authorization Bypass Via /remote_render7.5 High
- datacycle-engine datacycle-coredataCycle User Directory Enumeration Via /users/search4.3 Medium
- datacycle-engine datacycle-coredataCycle Public DataLink Text File Download Ignores Validity And Authorization7.5 High
- jxxghp moviepilotjxxghp MoviePilot Application API improper authorization5.3 Medium
- guohongze adminsetguohongze adminset Delivery Deployment Endpoint deli.py authorization5.3 Medium
- geex-arts django-jetgeex-arts django-jet Dashboard views.py authorization5.3 Medium
- zevorn rt-clawzevorn rt-claw RPC swarm.c claw_tool_invoke authorization6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization5.3 Medium
- sipeed picoclawSipeed PicoClaw Group Message wecom.go dispatchIncoming authorization5.3 Medium
- zevorn rt-clawzevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorization6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization4.8 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization5.3 Medium
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via Database Handlers9.3 Critical
- bunkerity bunkerwebbunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes5.4 Medium
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI add.php authorization5.3 Medium
- @better-auth sso, better-auth, better-auth better auth +1 more +3 moreBetter Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- Show moreLoading…