CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost, mattermost server +1 moreInsufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments4.3 Medium
- 84codes lavinmqLavinMQ has incomplete shovel configuration validation8.6 High
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +2 morePublic Dashboards time range restriction on annotations can be bypassed5.3 Medium
- apple macosAn injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia...5.5 Medium
- frappe learning, lms +1 moreFrappe LMS affected by unauthorised user was able to access the full list of batch enrolled students1.3 Low
- dani-garcia vaultwardenvaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions6.5 Medium
- kanboardKanboard is Missing Access Control on Plugin Installation leading to Administrative RCE8.5 High
- filebrowserFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL8.1 High
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Admin Privilege Escalation via Trusted JWT Claims9.3 Critical
- prasklatechnology placipy, praskla-technology assessment-placipy +1 morePlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)5.3 Medium
- step-security harden-runnerBypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)6.3 Medium
- wekanWeKan Rules rules.js RulesBleed authorization5.3 Medium
- wekanWeKan < 8.20 Migration Functionality Insufficient Permission Checks7.1 High
- wekanWeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass7.1 High
- wekanWeKan < 8.19 Cross-board Card Move Without Destination Authorization7.1 High
- wekanWeKan < 8.19 Read-only Board Roles Can Update Cards7.1 High
- wekanWeKan < 8.19 Attachment Upload Object Relationship Validation Bypass7.1 High
- lintsinghua deepauditDeepAudit Affected by User Enumeration via Broken Access Control2.1 Low
- gogsGogs user can update repository content with read-only permission6.5 Medium
- openfga, openfga helm charts +1 moreOpenFGA Improper Policy Enforcement5.8 Medium
- opencloud-eu reva, heinlein opencloud reva +1 moreREVA Public Link Exploit8.2 High
- tanium appliance, tanos +1 moreTanium addressed an improper input validation vulnerability in Tanium Appliance.2.7 Low
- tanium reputationTanium addressed an improper access controls vulnerability in Reputation.4.3 Medium
- teamviewer remote, samsung open source one, teamviewer tensor +2 moreImproper Access Control in TeamViewer clients7.2 High
- wekanWeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization5.3 Medium
- eladminA vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an...6.5 Medium
- moodleMoodle: moodle: privilege escalation via incomplete role checks in badge awarding5.4 Medium
- ibm jazz foundationIBM Jazz Foundation access control violation4.3 Medium
- crmebZhong Bang CRMEB crontab Endpoint CrontabController.php authorization6.9 Medium
- dcooney ajax load more – infinite scroll, load more, & lazy loadAjax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure5.3 Medium
- hiksemi hs-afs-s1h1Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can...4.3 Medium
- tanium serverTanium addressed an improper access controls vulnerability in Tanium Server.4.3 Medium
- budibaseBudibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role5.7 Medium
- tanium interactTanium addressed an improper access controls vulnerability in Interact.3.1 Low
- loft-sh loftvCluster Platform's Access Keys Allows Access Beyond Scope9.1 Critical
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT is Vulnerable to RCE via Disabled Block Execution8.6 High
- discourseDiscourse staff action logs expose sensitive information to moderators6.5 Medium
- discourseDiscourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change5.1 Medium
- discourseDiscourse moderators can access admin-only reports exposing private upload URLs7.1 High
- discourseDiscourse non-admin moderators can exfiltrate private content via post ownership transfer6.9 Medium
- discourseDiscourse users archives leaked to users with moderation privileges5.9 Medium
- discourseDiscourse AI Discover's continue conversation allows threat actor to impersonate user5.3 Medium
- tildeslash ltd. m/monit, tildeslash m\/monit +1 moreM/Monit 3.7.4 - Privilege Escalation8.7 High
- drupal canvasDrupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-0064.8 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in Pages Router applications using i18n7.5 High
- 2100 technology official document management system2100 Technology｜Official Document Management System - Incorrect Authorization7.1 High
- akuity kargoKargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access6.9 Medium
- vestacpVestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation8.7 High
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +12 more +14 moreDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation8.1 High
- amir20 dozzleDozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access8.7 High
- Show moreLoading…