CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- qgisQGIS had validated RCE and Repository Takeover via GitHub Actions8.7 High
- linuxfoundation everest, everest everest-core +1 moreEvseV2G has sequence state validation bypass4.3 Medium
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Incorrect Authorization Allows Administrator Password Change8.7 High
- melapress role editorMelapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment8.8 High
- free5gc nrfFree5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value9.1 Critical
- gitlabIncorrect Authorization in GitLab7.5 High
- joinmastodon mastodonMastodon has insufficient access control to push notification settings6.5 Medium
- joinmastodon mastodonMastodon may allow a remote suspension bypass5.3 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest allows null session ID to bypass session ID verification4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users6.5 Medium
- wukongopensource wukongcrm, 5kcrm wukong crm +1 moreWuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization5.3 Medium
- fleetdm fleetFleet has an Access Control vulnerability in debug/pprof endpoints6.3 Medium
- external-secrets, external-secrets external secrets operator, red hat external secrets operator for red hat openshift +1 more +3 moreExternal Secrets Operator insecurely retrieves secrets through the getSecretKey templating function9.3 Critical
- franklioxygen mytubeMyTube has an Authorization Bypass vulnerability9.8 Critical
- devolutions serverIncorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows...7.6 High
- microsoft power apps, power apps desktop client +1 morePowerApps Desktop Client Remote Code Execution Vulnerability8.0 High
- pimcore, pimcore web2print tools +1 morePimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization5.4 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreCertain system functions may be accessed without proper authorization, allowing attackers to...7.5 High
- https://github.com/shadowblip inputplumberLack of Authentication in the InputManager D-Bus interface8.5 High
- floattechnologies float payment gatewayFloat Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation5.3 Medium
- adobe dreamweaver desktop, dreamweaver +1 moreDreamweaver Desktop | Incorrect Authorization (CWE-863)7.8 High
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreNFSD: NFSv4 file creation neglects setting ACL8.0 High
- codepeople cp image store with slideshowCP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import4.3 Medium
- typo3, typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Edit Document Controller5.3 Medium
- lycheeorg lycheeLychee cross-album password propagation on Album unlocking2.3 Low
- viafirma documents, documents compose +1 moreMultiple vulnerabilities in Viafirma products8.7 High
- wpdevteam templately – elementor & gutenberg template library: 6500+ free & pro ready templates and cloud!Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write5.3 Medium
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure4.3 Medium
- palantir com.palantir.acme:dossier-app, com.palantir.acme:gotham-default-apps-bundle, com.palantir.acme:stencil-app-bundle +2 moreUnder certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended…3.5 Low
- wptb wp table builder – drag & drop table builderWP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation4.3 Medium
- zte mf258k, mf258k pro firmware +1 moreZTE MF258K Pro Version Server has a Configuration Defect Vulnerability4.3 Medium
- ghostGhost has Staff Token permission bypass8.1 High
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve is missing an authorization check in LFS lock deletion5.4 Medium
- getkirby kirbyKirby is missing permission checks in the content changes API5.8 Medium
- opexus ecase auditOPEXUS eCASE Audit incorrect access control7.2 High
- rustfsRustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation5.7 Medium
- nahian91 awesome hotel bookingAwesome Hotel Booking <= 1.0.3 - Incorrect Authorization to Unauthenticated Arbitrary Booking Modification5.3 Medium
- yerootech ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control8.7 High
- coollabs coolifyCoolify has a privilege escalation - low privileged user can invite themselves as an admin user8.7 High
- citeum openctiGraphQL IDOR allows authenticated user to delete workspace content of other users7.1 High
- plex media server, plex.tv backend +1 moreIn the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token...5.0 Medium
- plex media server, plex.tv backend +1 moreIn the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token...5.0 Medium
- plex media serverPlex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a ...8.5 High
- phpgurukul online course registrationPHPGurukul Online Course Registration authorization5.3 Medium
- fredtempez zwiicmsZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages5.3 Medium
- phpgurukul small crmPHPGurukul Small CRM edit-user.php authorization5.3 Medium
- temporalExecuteMultiOperation Namespace Policy Bypass1.3 Low
- temporalCross Namespace Commands Authorization Bypass5.3 Medium
- jeecg bootJeecgBoot getPositionUserList improper authorization2.3 Low
- jeecg bootJeecgBoot queryDepartPermission improper authorization2.3 Low
- Show moreLoading…