CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.4 High
- project-zot zotzot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion8.1 High
- arnasdon wacrmWACRM: Service-role routes missing a role check8.1 High
- ibm mqIBM MQ Console is vulnerable to privilege escalation7.1 High
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.8.1 High
- microsoft azure horizondbAzure Database for PostgreSQL Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability10.0 Critical
- h44z wg-portalWireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)4.3 Medium
- cisco ise passive identity connector, identity services engine software +1 moreCisco Identity Services Engine Authorization Bypass Vulnerability4.3 Medium
- cisco identity services engine softwareCisco Identity Services Engine Authorization Bypass Vulnerability4.3 Medium
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability9.0 Critical
- @fastify/auth@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth8.1 High
- oracle product workbenchVulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component:...5.4 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access7.2 High
- atlassian jira service management data centerThis High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira...7.1 High
- atlassian confluence data centerThis High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0,...7.1 High
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system adminappview.php session_start authorization6.9 Medium
- ibm sterling secure proxyIBM Sterling Secure Proxy is vulnerable to multiple issues4.3 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn authorization issue was addressed with improved access control. This issue is fixed in iOS 26...5.5 Medium
- apple ipados, tvos, visionos +3 more +5 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.4 Medium
- apple ipados, tvos, visionos +2 more +4 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macos, watchos +1 moreAn authorization issue was addressed with improved state management. This issue is fixed in macOS...3.5 Low
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macosAn authorization issue was addressed with improved access control. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization5.3 Medium
- code-projects inventory management systemSourceCodester Inventory Management System invoice.php authorization5.3 Medium
- jaygajera17 e-commerce-project-springbootjaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization5.3 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system Registration register.php createUserAccount improper authorization6.9 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization5.3 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization5.3 Medium
- phpgurukul bank locker management systemPHPGurukul Bank Locker Management System view-assign-locker.php authorization6.9 Medium
- lenve vhrlenve vhr Password Update pass HrInfoController.updatePass improper authorization5.3 Medium
- shopperdotcom shopperShopper: read-only team permissions allow administrator creation and permission escalation8.8 High
- openmrs org.openmrs.module:legacyui-apiOpenMRS has Broken Access Control in HL7 Configuration8.7 High
- getsimplecms, getsimplecms-ce +1 moreGetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw9.8 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.5 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.5 High
- hikvision wi-fi series cameraSome Wi-Fi series camera products have insufficient permission validation on certain interfaces,...4.3 Medium
- samsung android, samsung mobile devices +1 moreImproper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows...4.6 Medium
- seakee cpa-manager-plusseakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization6.9 Medium
- microsoft xbox gaming servicesXbox Gaming Services Elevation of Privilege Vulnerability7.8 High
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization6.9 Medium
- sfturing hosp ordersfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization6.9 Medium
- sfturing hosp ordersfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization6.9 Medium
- sfturing hosp ordersfturing hosp_order Order Controller OrderController.java authorization6.9 Medium
- mispMISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data7.1 High
- No product listedOpen5GS AMF/MME improper authorization5.3 Medium
- diem-project diemdiem-project diem dmWidget BasedmWidgetActions.class.php authorization6.9 Medium
- Show moreLoading…