CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlers5.3 Medium
openclawnpmOpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries7.1 High- openclawOpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration2.3 Low
- projectsendprojectsend AJAX Endpoints authorization5.3 Medium
- open-emr openemrOpenEMR: Therapy Group Sensitivity ACL No Longer Enforced7.7 High
- 9001 copypartyCopyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access2.3 Low
- olivetinOliveTin Unauthorized Action Output Disclosure via EventStream7.1 High
- studiocms, @studiocms s3-storage +1 moreStudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check7.6 High
- runzero platform, shopware, opnsense core +2 moreShopware unauthenticated data extraction possible through store-api.order endpoint8.9 High
- drupal unpublished node permissionsUnpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-0297.5 High
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-0287.5 High
- neo4j enterprise edition, neo4j +1 moreCaching of authentication context2.1 Low
- openprojectOpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets6.5 Medium
- openprojectOpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate4.3 Medium
- neo4j enterprise edition, neo4j +1 moreAuth misconfiguration when multiple providers enabled2.1 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
- neo4j enterprise edition, neo4j +1 moreIncorrect privilege assignment in composite databases2.0 Low
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 moreWorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode8.9 High
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 moreArgo Workflows has unauthorized access to Argo Workflows Template9.8 Critical
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)5.3 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)4.3 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)4.7 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.5 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)4.3 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.5 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)4.3 Medium
- istioIstio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.6.9 Medium
- project-zot zotzot create-only policy allows overwrite attempts of existing latest tag (update permission not required)7.7 High
- parse-community parse-serverParse Server session token exfiltration via `redirectClassNameForKey` query parameter9.9 Critical
- parse-community parse-serverParse Server ha a bypass of class-level permissions in LiveQuery8.7 High
- envoyproxy envoyEnvoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation7.5 High
- microsoft azure automation hybrid worker windows extensionHybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability7.8 High
- studiocmsStudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service7.1 High
- studiocmsStudioCMS Affected by Privilege Escalation via Insecure API Token Generation8.8 High
- openclawOpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command5.8 Medium
openclawnpmOpenClaw: system.run allow-always persistence included shell-commented payload tails5.0 MediumopenclawnpmOpenClaw: `operator.write` chat.send could reach admin-only config writes4.3 Medium- openclawOpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch2.1 Low
openclawnpmOpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping5.4 MediumopenclawnpmOpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers5.0 Medium- kubewarden kubewarden-controller, linuxfoundation kubewarden +1 morekubewarden-controller cross-namespace data exfiltration via deprecated host callback binding4.3 Medium
- pocket-id pocket id, pocket-id +1 morePocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange8.5 High
- parse-community parse-serverParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled6.9 Medium
- parse-community parse-serverParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters9.3 Critical
- gravitl netmakerNetmaker: Service User with Network Access Can Access config files with WireGuard Private Keys8.7 High
- gravitl netmakerNetmaker: Privilege Escalation from Admin to Super-Admin via User Update6.9 Medium
- gravitl netmakerNetmaker: Insufficient Authorization in Host Token Verification8.6 High
grumpydictator/firefly-iiiPackagistFirefly III user API endpoints expose all users' information to any authenticated user (IDOR)5.7 Medium- flowiseai flowiseFlowise Authorization Bypass via Spoofed x-request-from Header8.7 High
- mercurius-js mercuriusMercurius: queryDepth limit bypassed for WebSocket subscriptions2.7 Low
- Show moreLoading…