CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies5.3 Medium
- No product listedOpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization5.3 Medium
- patriksimek vm2vm2 before 3.11.6 Process-wide State Exposure via os and dns10.0 Critical
- webkul bagistoWebkul Bagisto Backend Sales RMA Endpoint requests authorization5.1 Medium
- webkul bagistoWebkul Bagisto Configuration Management execute authorization5.3 Medium
- No product listedAdblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization5.3 Medium
- belkin ax1800, gl.inet a1300, axt1800 +14 more +16 moreGL.iNet XE3000 WebDAV Service MOVE authorization6.9 Medium
- codecanyon timecamp integration for crmCodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization5.3 Medium
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities8.8 High
- webkul bagistoWebkul Bagisto Backend Reporting Endpoint sales authorization5.3 Medium
- webkul bagistoWebkul Bagisto Backend Customer Detail Feature view authorization5.3 Medium
- webkul bagistoWebkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization5.1 Medium
- francoisjacquet rosariosisfrancoisjacquet RosarioSIS Referrals.php DBUpdate authorization5.3 Medium
- ibm iIBM i is Affected By A Prvilege Escalation Vulnerability []8.2 High
- buildwps prevent direct access – protect wordpress filesPrevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access5.3 Medium
- ibm db2IBM® Db2® is vulnerable to privilege escalation with a specially crafted query8.2 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i4.3 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a privilege escalation8.1 High
- wintercms winterWinter: Authenticated backend users can bypass Users controller permission checks7.1 High
- frappe erpnextERPNext: Broken Access Control on certain endpoint6.5 Medium
- aehrc pathlingPathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation8.7 High
- microsoft copilot cowork, power apps +1 moreCopilot Cowork Elevation of Privilege Vulnerability9.3 Critical
- craftcms cmsArbitrary user password reset leading to administrator account takeover8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset7.1 High
- sophos endpoint for macos, home for macos +1 moreA privilege escalation vulnerability allows local users to execute arbitrary code as root via...9.3 Critical
- sourcecodester online examination & learning management systemSourceCodester Online Examination & Learning Management System view_students.php authorization5.3 Medium
- sourcecodester online examination & learning management systemSourceCodester Online Examination & Learning Management System view.php authorization5.3 Medium
- mf-yang openclaw-cnmf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization5.3 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization5.3 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization5.3 Medium
- zhayujie cowagentzhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization5.3 Medium
- drupal edit in-place fieldEdit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-0938.1 High
- jenkins project google chat notification pluginJenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the...4.3 Medium
- ehco1996 django-sspanelEhco1996 django-sspanel Support Ticket views.py TicketDetailView authorization5.3 Medium
- baserow b.v. baserowBaserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization2.1 Low
- flowiseai flowiseFlowise: Cross-workspace credential IDOR in openai-assistants-vector-store7.1 High
- nousresearch hermes-agentNousResearch hermes-agent Quick run.py _check_slash_access authorization5.3 Medium
- diaowen dwsurveydiaowen DWSurvey Survey Status up-survey-status.do improper authorization5.3 Medium
- diaowen dwsurveydiaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization5.3 Medium
- kalcaddle kodboxkalcaddle kodbox msgWarning Plugin action improper authorization6.9 Medium
- misskey-dev misskeyMisskey: Improper Authorization in the Announcements API6.3 Medium
- jeequan jeepayjeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization5.3 Medium
- gl.inet e5800, e750, x2000 +3 more +5 moreGL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization5.3 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreBigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox5.7 Medium
- activepiecesActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache9.3 Critical
- apache supersetApache Superset: Improper Authorization in Chart Update allowing Dashboard Modification5.3 Medium
- tigera calico, calico cloud, calico enterprise +2 moreCalico Tier Authorization Bypass via DeleteCollection6.2 Medium
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.25.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching6.5 Medium
- azukaar cosmos-serverCosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server6.1 Medium
- Show moreLoading…