CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google cloud buildGoogle Cloud Build Comment Control Bypass8.6 High
- openclawOpenClaw < 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOS7.3 High
- openclawOpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields8.6 High
- openclawOpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution5.7 Medium
- openclawOpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass9.4 Critical
- openclawOpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node2.0 Low
openclawnpmOpenClaw: Node exec approvals could be replayed across nodes6.9 Medium- openclawOpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence7.1 High
- openclawOpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run7.1 High
- openclawOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist2.0 Low
- openclawOpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access8.7 High
openclawnpmOpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization6.9 Medium- olivetinOliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login7.5 High
- openclawOpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata5.3 Medium
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 has IDOR in Collection Item Management5.7 Medium
- nest.js, nestjs nest, red hat developer hub +1 more +3 moreNestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass8.2 High
- soliton securebrowser for onegate, securebrowser ii, secureworkspace +1 more +3 moreThe installers for multiple products provided by Soliton Systems K.K. contain an issue with...5.4 Medium
- openclawOpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins8.7 High
- openclawOpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode9.9 Critical
- zulipZulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users7.1 High
- discourseDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category1.2 Low
- discourseDiscourse doesn't prevent moderators from exporting user Chat DMs1.3 Low
- discourseDiscourse doesn't scope reviewable notes to user-visible reviewables4.3 Medium
- discourseDiscourse has IDOR vulnerability in the directory items endpoint7.5 High
- fleetdm fleetFleet: Authorization Bypass in certificate template batch deletion for team administrators1.2 Low
- h44z wg-portal, wgportal wireguard portal +1 moreWireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update8.8 High
- drupal material iconsMaterial Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-0115.3 Medium
- open-emr openemrOpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource5.7 Medium
- rustfsRustFS's Missing Post Policy Validation leads to Arbitrary Object Write8.1 High
- open-emr openemrOpenEMR has Broken Access Control on Care Coordination Module7.0 High
- devolutions serverA permission cache poisoning vulnerability in Devolutions Server allows authenticated users to...4.3 Medium
- apache supersetApache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass7.1 High
- apache supersetApache Superset: SQLLab Read-Only Bypass on PostgreSQL7.1 High
- dromara ruoyi-vue-plusDromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization5.3 Medium
- ciliumCilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled6.1 Medium
- hyland alfresco community, alfresco enterprise, alfresco content services +2 moreHyland Alfresco Improper Authorization Arbitrary File Read8.7 High
- akuity kargoKargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints9.4 Critical
- epson printer controller installermacOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer7.8 High
- github enterprise serverIncorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests7.1 High
- open-policy-agent opa-envoy-pluginopa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in `input.parsed_path`7.1 High
- posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerceThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'p…4.3 Medium
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter5.3 Medium
- openclawOpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages8.2 High
- openclaw, clawdbot +1 moreOpenClaw iMessage group allowlist authorization inherited DM pairing-store identities6.5 Medium
clawdbotnpm,openclawnpm +1 moreOpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch2.1 Low- openclawOpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command7.2 High
- openclaw, openclaw nextcloud-talk +1 moreOpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing9.3 Critical
- openclaw, openclaw @openclaw/bluebubbles +1 moreOpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust7.5 High
- gogsGogs has a Protected Branch Deletion Bypass in Web Interface7.1 High
- mattermost, mattermost zoom, server +2 moreMattermost Zoom Plugin channel preference API lacks authorization checks4.3 Medium
- Show moreLoading…