CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- jeecg bootJeecgBoot list getParameterMap improper authorization2.3 Low
- jeecg bootJeecgBoot datarule improper authorization2.3 Low
- jeecg bootJeecgBoot datarule loadDatarule improper authorization2.3 Low
- jeecg bootJeecgBoot getDeptRoleList improper authorization2.3 Low
- jeecg bootJeecgBoot list queryPageList improper authorization2.3 Low
- giteaGitea mishandles access to a private resource upon receiving an API token with scope limited to public resources4.9 Medium
- giteaGitea doesn't adequately enforce branch deletion permissions after merging a pull request.3.1 Low
- giteaGitea mishandles authorization for deletion of releases4.3 Medium
- youlai youlai-mallyoulaitech youlai-mall Balance MemberController.java deductBalance improper authorization5.3 Medium
- pexip infinityPexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP...5.9 Medium
- pexip infinityPexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler...8.2 High
- guangzhou v-solution electronic technology co., ltd. sol gpon/epon olt platformV-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter8.7 High
- microhard systems 3g/4g cellular ethernet and serial gateway service control dos, microhardcorp bullet-3g firmware, bullet-lte firmware +9 more +11 moreMicrohard Systems IPn4G 1.1.0 Service Control Denial of Service7.1 High
- eclipse foundation bluechiBluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies7.2 High
- mattermost, mattermost server +1 moreMattermost Jira plugin crafted action leaks Jira issue details4.1 Medium
- mattermost, mattermost server +1 moreUnauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3 Medium
- kedacore kedaKEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential8.2 High
- galetteGalette has groups managers access control bypass on Members2.1 Low
- galetteGalette has access control bypass1.3 Low
- elastic kibanaKibana Improper Authorization4.3 Medium
- elastic kibanaKibana Improper Authorization4.3 Medium
- m-files serverImproper access validation in M-Files Server5.3 Medium
auth0/wordpressPackagistAuth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency6.8 Mediumauth0/symfonyPackagistAuth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK6.8 Mediumauth0/loginPackagistAuth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency6.8 Medium- auth0 auth0-php, laravel-auth0, symfony +1 more +3 moreAuth0-PHP SDK has Improper Audience Validation6.8 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass4.3 Medium
- mattermost, mattermost server +1 moreLack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7 Low
- acer listcheck.exeAcer｜ListCheck.exe - Local Privilege Escalation8.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's...2.7 Low
- auth0 nextjs-auth0Auth0 Next.js SDK has Improper Request Caching Lookup5.4 Medium
- toto link x5000r's (ax1800 router), totolink x5000r firmware +1 moreUnauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password9.8 Critical
- tecno audiolink, com.transsion.audiosmartconnect +1 moreUnprotected service in the AudioLink component allows a local attacker to overwrite system files...5.3 Medium
- fortinet fortiportalAn Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow...6.4 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4)....4.3 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 moreCVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT4.2 Medium
- linuxfoundation strimzi, strimzi strimzi-kafka-operator +1 moreStrimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands7.4 High
- frappe learning, lms +1 moreFrappe LMS is Missing Server-Side Authorization in Business Logic1.3 Low
- macrozheng mall-swarmmacrozheng mall-swarm delete improper authorization5.3 Medium
- difuse kalmiaKalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth...6.5 Medium
- drupal entity shareEntity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-1235.3 Medium
- splunk mcp serverSPL commands allowlist controls bypass in Splunk MCP Server app through "run_splunk_query" MCP tool5.4 Medium
- masacmsMasa CMS vulnerable to authentication bypass with /tag/7.5 High
- smallstep certificatesImproper Authorization Check for SSH Certificate Revocation5.0 Medium
- mattermost, mattermost server +1 moreInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion4.3 Medium
- floragunn search guard flxUnauthorized access to documents in data streams with specially crafted requests4.3 Medium
- data illusion zumbrunn ngsurveyIncorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in...8.6 High
- moxi159753 mogu blog v2, mogublog project mogublog +1 moremoxi159753 Mogu Blog v2 Storage Management Endpoint storage authorization6.3 Medium
- nutzam nutzbootnutzam NutzBoot Transaction API EthModule.java improper authorization6.9 Medium
- qualcomm fastconnect 6200 firmware, fastconnect 6700 firmware, fastconnect 6900 firmware +97 more +99 moreIncorrect Authorization in Boot7.8 High
- Show moreLoading…