CWE-425: Direct Request
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Also known as Forced Browsing.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation ofbiz Apache OFBiz: Authenticated Code Execution Vulnerability 8.8 High
- apache software foundation ofbiz Apache OFBiz: Missing Authorization vulnerability No score
- apache software foundation ofbiz Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations No score
- apache software foundation ofbiz Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities No score
- apache software foundation ofbiz Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation No score
- apache software foundation ofbiz Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification No score
-
github.com/charmbracelet/soft-serveGo charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories 5.3 Medium - satya-vinay events-management-system satya-vinay Events-Management-System project.sql file access 6.9 Medium
- code-projects matrimonial system code-projects Matrimonial System matrimony.sql file access 6.9 Medium
- red hat exploit intelligence, build of quarkus 3.27.6.redhat, build of quarkus 3.33.4.redhat +2 more Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations 9.1 Critical
- kentico xperience Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration... 4.3 Medium
- comelit group s.p.a. 1456b multi-user gateway Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint 8.8 High
- moodle Moodle: missing capability check allows unauthorised grade penalty recalculation 4.3 Medium
- moodle Moodle: incorrect capability check in ai generate image web service 2.7 Low
- moodle Moodle: manual enrolment page accessible when plugin disabled 2.2 Low
- synology diskstation manager (dsm) A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation... 6.5 Medium
- rhymix Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can... 7.4 High
- alexta69 metube alexta69 MeTube Cookie File cookies.txt file access 6.9 Medium
- frauscher sensortechnik fds 102 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control 5.3 Medium
- code-projects login registration system code-projects Login Registration System SQL Database Backup login_registration_system.sql file access 6.9 Medium
- sourcecodester online clothing store SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access 6.9 Medium
- sharp corporation mfps, toshiba tec corporation tec mfps +1 more Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to... 6.9 Medium
- hcl software devops loop Unauthorized Access to Admin Functionality via Forced Browsing 4.6 Medium
- hcl software aftermarket epc HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that... 3.7 Low
- agentejo cockpit cms, cockpit cms +1 more agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access 6.9 Medium
- mb connect line mbconnect24, mymbconnect24 +1 more Authenticated unintended access to critical program parameters 8.6 High
- ibm datacap, datacap navigator +1 more Multiple Vulnerabilities in IBM Datacap 2.3 Low
- wertheim gmbh safecontroller software for vault rooms (safe deposit locker system) Unauthenticated direct access to web data in Wertheim SafeController Software exposes files 6.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.5, jboss enterprise application platform expansion pack +1 more +3 more Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak 4.9 Medium
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar 6.3 Medium
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 more Argo Workflows Is Missing Authorization in Sync ConfigMap Provider 8.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 more Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled 5.4 Medium
- gfi software helpdesk Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via... 4.3 Medium
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 more LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint 8.7 High
- mrcms MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file... 5.3 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow 8.1 High
- code-projects online food ordering system code-projects Online Food Ordering System localhost.sql privilege escalation 6.9 Medium
- open-emr openemr OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data 7.7 High
- open-emr openemr OpenEMR has Improper ACL On Import/Export Popup 5.4 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 more NATS allows MQTT clients to bypass ACL checks 7.1 High
- code-projects simple food ordering system, carmelo simple food order system +1 more code-projects Simple Food Ordering System Database Backup food.sql file access 6.9 Medium
- spring security, vmware spring security +1 more Under Some Conditions Spring Security HTTP Headers Are not Written 9.1 Critical
- opexus ecomplaint, opexustech ecase ecomplaint +1 more OPEXUS eComplaint unauthenticated file upload 5.3 Medium
- tinycontrol lk3.9, lk4, tcpdu +1 more +3 more Credentials exposure in tinycontrol devices 8.6 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 more Incorrect parsing of IPv6 host literals in net/url 7.5 High
- kalyan02 nanocms kalyan02 NanoCMS User Information pagesdata.txt direct request 6.9 Medium
- algo 8180 ip audio alerter, algosolutions 8180 ip audio alerter firmware +1 more ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability 5.3 Medium
- aptsys gemscms backend A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which... 9.4 Critical
- openflagr flagr OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization 9.3 Critical
- pbootcms PbootCMS SQLite Database pbootcms.db file access 6.3 Medium
- Show olderLoading…