CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- parse-community parse-serverParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user8.5 High
- parse-community parse-serverParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction6.9 Medium
- zabbixUnauthorized host creation via configuration.import API by low-privilege user with write permissions5.1 Medium
- acronis cyber protect 17, cyber protect +1 moreSensitive information disclosure due to improper access control. The following products are...4.3 Medium
- acronis cyber protect 17, cyber protect +1 moreUnauthorized data access due to insufficient access control validation. The following products...4.3 Medium
- acronis cyber protect 17, cyber protect +1 moreUnauthorized report deletion due to insufficient access control. The following products are...4.3 Medium
- acronis cyber protect 17, cyber protect +1 moreUnauthorized modification of settings due to insufficient authorization checks. The following...4.3 Medium
- acronis cyber protect 17, cyber protect +1 moreUnauthorized resource manipulation due to improper authorization checks. The following products...4.3 Medium
- acronis cyber protect 17, cyber protect +1 moreInformation disclosure and manipulation due to improper authorization checks. The following...4.4 Medium
- acronis cyber protect 17, cyber protect +1 moreSensitive information disclosure due to improper authorization checks. The following products are...6.5 Medium
- acronis cyber protect 17, cyber protect +1 moreUnauthorized resource manipulation due to improper authorization checks. The following products...4.3 Medium
- hex hexpm, hexpm hex.pm +1 moreImproper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access7.0 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +5 more +7 moreOrg.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)8.1 High
- octopus serverIn affected versions of Octopus Server it was possible to create a new API key from an existing...2.3 Low
- international datacasting corporation sfx2100 satellite receiver, datacast sfx2100 firmware +1 moreIncorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX21009.2 Critical
- international datacasting corporation sfx2100 satellite receiver, datacast sfx2100 firmware +1 moreWorld-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE8.5 High
- parse-community parse-serverParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction8.6 High
- dani-garcia vaultwardenVaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role8.3 High
- dani-garcia vaultwardenVaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager8.3 High
- hono node-server@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware7.5 High
- openclawOpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration6.3 Medium
- openclawOpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store2.0 Low
- openclawOpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip7.6 High
- drupal file access fix (deprecated), geeks4change file access fix +1 moreFile Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-0215.3 Medium
- drupal file access fix (deprecated), geeks4change file access fix +1 moreFile Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-0205.3 Medium
- dell device management agent (ddma), device management agent +1 moreDell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization...5.5 Medium
- checkmkDeletion of passwords via RestApi5.3 Medium
- openclawOpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authentication5.3 Medium
openclawnpmOpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch5.3 Medium- openclawOpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run7.1 High
- openclawOpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender6.0 Medium
- openclawOpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass6.3 Medium
- openclawOpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds8.3 High
- openclawOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlist2.3 Low
openclawnpmOpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt7.3 High- openclawOpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation7.3 High
- openclawOpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom6.3 Medium
- openclawOpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication8.7 High
- openclawOpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass7.6 High
openclawnpmOpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows4.8 Medium- openclawOpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler5.8 Medium
- openclawOpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress6.3 Medium
- openclawOpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run6.0 Medium
- ibm engineering requirements management doors nextIBM Engineering Requirements Management DOORS Next could allow an authenticated user to access and modify data beyond authorized permissions5.4 Medium
- openclawOpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers5.3 Medium
- openclawOpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv Carriers5.8 Medium
- openclawOpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist7.1 High
- openclawOpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run6.0 Medium
- openclawOpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization6.9 Medium
openclawnpmOpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection7.1 High- Show moreLoading…