CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- jofpin trapejofpin trape user.py authorization6.9 Medium
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]4.3 Medium
- ibm iIBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]8.1 High
- light0011 cmslight0011 cms Chapter Controller ChapterController.class.php authorization6.9 Medium
- No product listedAn issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a...6.5 Medium
- light0011 cmslight0011 cms Chapter Controller ChapterController.class.php _initialize authorization6.9 Medium
- specterops bloodhoundSpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Session Management s71.py _sess_nowait authorization6.9 Medium
- craftcms cmsCraft CMS before 5.11.0 PII Disclosure via GraphQL User Relations5.3 Medium
- invoice ninja ninja, invoiceninja invoice ninja +1 moreinvoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization5.3 Medium
- google android, pixel +1 moreIn Cellular Modem, there is a possible permission bypass due to a logic error in the code. This...8.8 High
- dibo-software dibootdibo-software diboot AI Session Endpoint ai-session authorization5.3 Medium
- soarkey studentmanagement, 学生信息管理系统 +1 moreSoarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization6.9 Medium
- seacmsSeaCMS ass.php authorization6.9 Medium
- lognet grpc-spring-boot-starterLogNet grpc-spring-boot-starter Annotation Processing improper authorization2.3 Low
- itsourcecode student management systemsambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization5.3 Medium
- admidioAdmidio before 5.0.12 Broken Access Control via profile_function.php5.3 Medium
- yamcsYamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration4.3 Medium
- go-vikunja vikunjaVikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api8.1 High
- go-vikunja vikunjaVikunja: Project duplication bypasses write-permission check on the target parent project5.3 Medium
- cephCeph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users9.1 Critical
- dassault systèmes 3dswymerImproper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x9.3 Critical
- weblateorg weblateWeblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint4.3 Medium
- admin by request (abr) by request (abr)Insecure PIN derivation mechanism in Admin By Request (ABR)8.8 High
- doorkeeper-gem doorkeeper-openid connectDoorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes4.2 Medium
- djust-org djustdjust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls8.2 High
- liketrek trekliketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization6.3 Medium
- aureus erpDolibarr ERP User Notes note.php authorization5.3 Medium
- No product listedOpen5GS AMF UEContextReleaseRequest Path improper authorization5.3 Medium
- code-projects barangay resident profiling management systemcode-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization5.3 Medium
- code-projects barangay resident profiling management systemcode-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization5.3 Medium
- dromara ruoyi-vue-plusDromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization5.3 Medium
- dolibarrDolibarr Account card.php improper authorization5.3 Medium
- apache cloudstackApache CloudStack: ProjectRole & ProjectRolePermission authorization issue7.2 High
- laravel-backpack crudbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk8.1 High
- django cms association django-cmsdjango CMS: Structure endpoint bypasses page-view permission6.5 Medium
- elunez eladminelunez eladmin GenConfigController improper authorization5.3 Medium
- sony xav-9500esSony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability2.4 Low
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization5.3 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.1 High
- splunk, splunk enterprise +1 moreImproper Authorization through the REST API in Splunk Enterprise8.8 High
- termix-ssh termixTermix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users9.6 Critical
geolensPyPIGeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)No score- langchain-ai langgraph-apilanggraph-api: Incomplete assistant authorization in LangGraph Server run creation5.9 Medium
- apache tomcatApache Tomcat: Servlet role references can bypass declarative role constraints8.1 High
- buildwps ppwp – password protect pagesPPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure4.3 Medium
- atlassian bamboo, bamboo data center +1 moreThis High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0...7.6 High
- oracle helidonVulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web...6.1 Medium
- saleorSaleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check6.5 Medium
- Show moreLoading…