CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- mispMISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes7.1 High
- immich-app immichimmich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization6.9 Medium
- No product listedDeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An...9.1 Critical
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Admin Area admin authorization5.3 Medium
- vaadin, vaadin vaadin-spreadsheet, vaadin-spreadsheet-flow +2 moreMissing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells5.3 Medium
- grafana enterprise, oss +1 moreEditor can forge file-provisioning provenance on dashboards via the dashboard API5.4 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Configuration sistem.php simpan improper authorization5.1 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement laporan_data_pasien.php detail authorization5.1 Medium
- watchguard fireware, fireware os +1 moreFireware OS Improper Authorization in Access Portal Reverse Proxy5.3 Medium
- watchguard fireware, fireware os +1 moreFireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access7.2 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution4.3 Medium
- realjerrytang tacomallrealjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization6.9 Medium
- owen2345 camaleon cmsowen2345 Camaleon CMS Media Crop media_controller.rb crop authorization5.3 Medium
- bradwenqiang hrFrappe HR Permission Validation __init__.py get_attendance_requests authorization5.3 Medium
- fuzui studentinfofuzui StudentInfo Password Change Endpoint moditypasswordstu authorization5.1 Medium
- krayin laravel-crmKrayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization6.9 Medium
- zhistaredu startrainingzhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization5.3 Medium
- glpi-project glpiGLPI: Unallowed modfication of knowbase items comments and translations5.3 Medium
- glpi-project glpiGLPI: Unallowed authentication method update by administrator5.9 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation6.6 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data5.3 Medium
- sanluan publiccmsSanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization5.1 Medium
- cyber-iii student-management-systemningzichun student-management-system editLog.php authorization6.9 Medium
- cyber-iii student-management-systemningzichun student-management-system getStudent.php authorization6.9 Medium
- chillzhuang springbladechillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization5.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization6.9 Medium
- amir20 dozzleDozzle label filters do not restrict container event and statistics streams4.3 Medium
- ixofoundation ixo-blockchainixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass9.3 Critical
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization6.9 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization6.9 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization6.9 Medium
- kvcache-ai mooncakekvcache-ai mooncake RPC Path UnmountSegment authorization6.9 Medium
- neethuharii cafemanagementNeethuharii CafeManagement AddCashierCode.php addcashier improper authorization6.9 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities9.9 Critical
- nautobotNautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs6.4 Medium
- twentyhq twentyTwenty: Field-level read bypass7.1 High
- mispMISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction5.3 Medium
- mispMISP: Disabled-user check ineffective in pre-authentication TOTP login branch6.9 Medium
- mispMISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add5.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks6.3 Medium
- qualcomm software center, qualcomm, inc. snapdragon +1 moreImproper authorization in Qualcomm Software Center9.8 Critical
- 1panel-dev maxkbMaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation6.5 Medium
- warp-tech warpgateWarpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions7.7 High
- mispMISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)6.9 Medium
- omega solution fbp fulfillment by peopleOmega Solution FBP Fulfillment by People User Profile API user authorization5.3 Medium
- dromara ujcmsDromara UJCMS UserController UserController.java usernameExist improper authorization6.9 Medium
- grimmory-tools grimmorygrimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization5.3 Medium
- grimmory-tools grimmorygrimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization5.3 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.6 High
- Show moreLoading…