CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass 5.3 Medium
- go-vikunja vikunja Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload 6.9 Medium
- go-vikunja vikunja Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints 5.3 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & maps WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert 8.1 High
- unknown event tickets with ticket scanner Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend 4.2 Medium
- unknown directorist: ai-powered business directory, listings & classified ads Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action 5.0 Medium
- unknown directorist: ai-powered business directory, listings & classified ads Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout 3.1 Low
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.1 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.3 Medium
- ibm aspera faspex IBM Aspera Faspex Authorization Bypass 9.8 Critical
- karlomikus bar-assistant Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy 5.3 Medium
- freescout-help-desk freescout FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass 5.4 Medium
- jetbrains junie github action In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was... 7.4 High
- wazuh wazuh-dashboard-plugins Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request 8.8 High
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS... 3.8 Low
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible... 3.8 Low
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via... 6.4 Medium
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed... 7.1 High
- jetbrains youtrack In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message... 7.7 High
- jetbrains hub In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible 3.1 Low
- jetbrains hub In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible 7.5 High
- jetbrains hub In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the... 8.1 High
- jetbrains datalore In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files 5.4 Medium
- jetbrains datalore In JetBrains Datalore before 2026.4 private notebook files could be downloaded without... 5.9 Medium
- jetbrains datalore In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file... 5.9 Medium
- jetbrains datalore In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only... 6.5 Medium
- jetbrains datalore In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published... 8.1 High
- jetbrains datalore In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by... 9.0 Critical
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow 4.9 Medium
- dvankooten mc4wp: mailchimp for wordpress MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override 5.3 Medium
- red hat exploit intelligence, build of quarkus +1 more Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort 4.3 Medium
- subnet solutions powersystem center 2020, powersystem center 2024, powersystem center 2026 +2 more Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to... 9.4 Critical
- dagu-org dagu Dagu MCP DAG specification read bypasses path containment and workspace isolation 6.5 Medium
- kubeflow pipelines Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines 7.2 High
- jhuckaby cronicle Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 9.0 Critical
- suitecrm SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php 6.5 Medium
- suitecrm SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage 6.5 Medium
- altium 365 Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes 7.2 High
- apache software foundation ofbiz Apache OFBiz: Content Manager VIEW-only RCE in updateLayout 8.8 High
- apache software foundation ofbiz Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login 5.4 Medium
- agentscope-ai agentscope agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization 6.9 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solution Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation 2.7 Low
- unknown dokan: ai powered woocommerce multivendor marketplace solution Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint 6.5 Medium
- kyverno Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling 8.3 High
- kyverno Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader 9.4 Critical
- symfony Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls 6.3 Medium
- pocket-id Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences 7.7 High
- Show olderLoading…