CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- runzero platformrunZero Platform user creation leak5.8 Medium
- runzero platformrunZero Platform MCP information leak5.8 Medium
- erlang otp, erlang\/inets, erlang\/otp +3 more +5 moreScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)8.3 High
- openfga, openfga helm charts +1 moreOpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision5.0 Medium
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io has an Authentication Bypass via Decorator Ordering9.8 Critical
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization6.9 Medium
- pyloadpyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution7.5 High
- directusDirectus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries8.1 High
- directusDirectus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite7.1 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 moreLiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint8.7 High
- openprinting cupsOpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup4.8 Medium
- canonical jujuJuju: Resource poisoning7.1 High
- canonical jujuJuju: Read All Controller Logs From Compromised Workload6.9 Medium
- openclawOpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension2.3 Low
- openclawOpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands2.3 Low
- openclawOpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection7.6 High
- openclawOpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist2.3 Low
- openclawOpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch7.7 High
- openclawOpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication7.7 High
- openclawOpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass7.7 High
- microsoft azure sre agent, azure sre agent gateway - signalr hub +1 moreAzure SRE Agent Information Disclosure Vulnerability8.6 High
- microsoft azure kubernetes serviceMicrosoft Azure Kubernetes Service Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure ai foundryAzure AI Foundry Elevation of Privilege Vulnerability10.0 Critical
- openclawOpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History5.3 Medium
- openclawOpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation2.3 Low
- openclawOpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages2.3 Low
- openclawOpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation9.0 Critical
- mervinpraison praisonaiPraisonAI: Authentication Bypass in OAuthManager.validate_token()9.1 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins7.1 High
- mrmn2 pdfdingPdfDing: Password-protected share bypass via direct serve endpoint7.5 High
- xenforoXenForo OAuth2 Unauthorized Scope Request8.7 High
- openclawOpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables7.0 High
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command8.4 High
- openclawOpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions5.3 Medium
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter5.3 Medium
- openclawOpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter6.0 Medium
- openclawOpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands8.7 High
- b3log siyuanSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content7.5 High
- mrmn2 pdfdingPdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints6.5 Medium
- scitokens scitokens-cpp, cpp library +1 moreSciTokens C++: Sibling-Path Authorization Bypass8.1 High
- parse-community parse-serverParse Server: Cloud function validator bypass via prototype chain traversal9.1 Critical
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval9.4 Critical
- openclawOpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions5.3 Medium
- openclawOpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve8.6 High
- openclawOpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel6.9 Medium
- powerdns dnsdistDNS over HTTPS ACL bypass6.5 Medium
- openclawOpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request7.2 High
- openclawOpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint5.3 Medium
- lollms, parisneo parisneo/lollms +1 moreInsecure Direct Object Reference (IDOR) in parisneo/lollms8.3 High
- openclawOpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass6.9 Medium
- Show moreLoading…