CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke6.9 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession6.1 Medium
- openclawOpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks6.9 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName2.3 Low
- openclawOpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution7.1 High
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route7.1 High
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass5.3 Medium
- openclawOpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices6.9 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope8.7 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect8.5 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim8.7 High
- openclawOpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint7.2 High
- joinmastodon mastodonMastodon has a denial of service for quote authorization4.8 Medium
- wwbn avideoAVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php5.3 Medium
- moby, docker engine +1 moreMoby: AuthZ plugin bypass with oversized request body8.8 High
- anjoy8 blog.admin, blog.core +1 moreA blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access...4.3 Medium
- openclawOpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool6.0 Medium
- openclawOpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution6.9 Medium
- openclawOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat6.3 Medium
- openclawOpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook6.0 Medium
- openclawOpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk2.3 Low
- openclawOpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist6.3 Medium
- openclawOpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM6.9 Medium
- openclawOpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch6.9 Medium
- openclawOpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions2.3 Low
- openclawOpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper7.7 High
- openclawOpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling6.9 Medium
- statamic cms, statamic +1 moreStatamic's live preview token bypasses content protection for unrelated entries4.3 Medium
- error311 fileriseFileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content4.3 Medium
- blakeblackshear frigateFrigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp6.5 Medium
- blakeblackshear frigateAuthenticated Frigate users can read the full unredacted configuration via `/api/config/raw6.5 Medium
- ciliumCilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic5.4 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has RemoteStop Bypass via BCB Toggle Session Restart5.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has Delayed Authorization Response Bypasses Termination After RemoteStop5.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted5.0 Medium
- mattermost, mattermost server +1 moreGuest users can view group member IDs without respecting view restrictions4.3 Medium
- mattermost, mattermost server +1 moreInsufficient authorization in shared channel membership sync grants team-level access instead of channel-level access5.4 Medium
- hijiffy chatbotIncorrect authorization in HiJiffy Chatbot6.9 Medium
- hijiffy chatbotIncorrect authorization in HiJiffy Chatbot6.9 Medium
- n8nn8n Has External Secrets Authorization Bypass in Credential Saving7.3 High
- n8nn8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK6.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab3.7 Low
- apple ipados, macos, visionos +3 more +5 moreThis issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7...3.3 Low
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS allows MQTT clients to bypass ACL checks7.1 High
- linuxfoundation nats-serverNATS: Message tracing can be redirected to arbitrary subject4.3 Medium
- error311 fileriseFileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback7.1 High
- parse-community parse-serverParse Server: Session update endpoint allows overwriting server-generated session fields5.3 Medium
- go-vikunja vikunjaVikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read6.5 Medium
- go-vikunja vikunjaVikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect7.1 High
- Show moreLoading…