CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- mispMISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution7.1 High
- donetickdonetick History Deletion model.go CanDeleteHistory improper authorization5.3 Medium
- calcom cal.com, cal.diy +1 morecalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization5.3 Medium
- admidioAdmidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php5.3 Medium
- ibm iIBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System5.4 Medium
- ibm iIBM i is Affected by an Improper Validation Vulnerability3.7 Low
- mailuMailu: Domain managers can allow themselves to spoof on other hosted domains they should not control8.2 High
- mailuMailu domain managers can take over higher-privileged accounts7.2 High
- open-zaakOpen Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token6.5 Medium
- lycheeorg lycheeLychee: Album password bypass in ZIP downloads8.2 High
- invoiceshelfInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure8.2 High
- giteaGitea organization listing token scope bypass4.3 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows StateRepository API Elevation of Privilege Vulnerability7.8 High
- sourcecodester simple cafe billing systemSourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization6.9 Medium
- froxlorFroxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API5.3 Medium
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization6.9 Medium
- ibm planning analyticsIBM Planning Analytics Local is affected by security vulnerabilities7.1 High
- elated-themes frappeFrappe before 13.22.0 Improper Authorization via Document Rename5.3 Medium
- 0xjacky nginx-uiNginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint8.7 High
- getkirby kirbygetkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization5.3 Medium
- tobychui zoraxytobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization6.9 Medium
- blackbelttechnology pi-agent-dashboardBlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization5.3 Medium
- No product listedSEMCMS SEMCMS_User.php user improper authorization6.9 Medium
- zkteco biotimeZKTeco BioTime Employee REST API employees authorization5.3 Medium
- zkteco biotimeZKTeco BioTime Biometric Data Endpoint finger_data authorization5.3 Medium
- berriai litellmBerriAI LiteLLM Secret Resolution main.py get_secret improper authorization5.3 Medium
- berriai litellmBerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization5.3 Medium
code.vikunja.io/apiGoVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal2.3 Low- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.9 Medium
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Improper Authorization7.4 High
- splunk, splunk enterprise +1 moreImproper Authorization in Search Job Listings through the REST API in Splunk Enterprise4.3 Medium
- giteaGitea fork workflow approval bypass through cancel and rerun8.8 High
- phpgurukul user registration & login and user management systemPHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization5.1 Medium
- jishenghua jsherpjishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization5.3 Medium
- chillzhuang springbladechillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization5.1 Medium
- chillzhuang springbladechillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization5.1 Medium
- No product listedPickMall Lilishop Buyer Invoice List receipt authorization5.3 Medium
- No product listedPickMall Lilishop Mobile Binding bindMobile improper authorization6.9 Medium
- onetwothreeneth hospitalmanagementsystemonetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization6.9 Medium
- makeplane planePlane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)5.4 Medium
- totolink a3002muTotolink A3002MU Authentication Check boa sub_40FCFC improper authorization10.0 Critical
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Role Attribute admin.php authorization5.3 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Customer Information API customer-currency authorization5.3 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Customer Profile API customer authorization5.3 Medium
- openidentityplatform openamOpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping6.9 Medium
- openidentityplatform openamOpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows7.6 High
- legion of the bouncy castle inc. bc-javaOpenPGP certification accepted from a subkey without certification authority8.2 High
- mispMISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization5.3 Medium
- mispMISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging7.1 High
- mispMISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions5.3 Medium
- Show moreLoading…