CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- silverstripe silverstripe-assetsSilverstripe Assets Module has a DBFile::getURL() permission bypass5.3 Medium
- froxlorFroxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing5.0 Medium
- froxlorFroxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()5.4 Medium
- istioIstio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass5.4 Medium
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API5.3 Medium
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims6.8 Medium
- red hat openshift virtualization 4Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation5.4 Medium
- sailpoint technologies identityiqSailPoint IdentityIQ Debug UI Incorrect Authorization8.4 High
- rapid7 velociraptorVelociraptor Query() Plugin Misapplies Permissions To Orgs8.0 High
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreIncorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.07.2 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Privilege Escalation via API User Role Modification8.8 High
- kiuwan sastImproper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST5.4 Medium
- craigjbass clearancekitClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path6.8 Medium
- lin-snow ech0Ech0 before 4.4.3 Scope Bypass via profile:read Token8.5 High
- mervinpraison praisonaiPraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching6.8 Medium
- mervinpraison praisonaiPraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override8.7 High
- go-vikunja vikunjaVikunja's Scoped API tokens with projects.background permission can delete project backgrounds4.3 Medium
- go-vikunja vikunjaVikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug4.3 Medium
- systemdIn systemd 259 before 260, there is local privilege escalation in systemd-machined because...6.7 Medium
- davidanderson wp-optimize – cache, compress images, minify & clean database to boost page speed & performanceWP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation5.4 Medium
- openstack keystoneOpenStack Keystone: Restricted application credentials can create EC2 credentials3.5 Low
- openclawOpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication6.0 Medium
- openclawOpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope8.7 High
- openclawOpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass7.3 High
- openclawOpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes2.3 Low
- openclawOpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass7.6 High
- openclawOpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function7.7 High
- lycheeorg lycheeLychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users2.3 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Fleet Leading to Information Disclosure4.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Fleet Leading to Information Disclosure7.7 High
- pyloadpyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions5.4 Medium
- go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 moreCode execution vulnerability in SWIG code generation in cmd/go8.8 High
- parse-community parse-serverParse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`5.3 Medium
- openclawOpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding5.4 Medium
- openclawOpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations5.3 Medium
- openclawOpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config7.1 High
- openclawOpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints7.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families8.1 High
- hkuds openharnessOpenHarness Improper Access Control via File Tools8.4 High
- filebrowserFile Browser share links remain accessible after Share/Download permissions are revoked8.2 High
- pyload, pyload-ng project pyload-ng +1 moreAuthorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng6.8 Medium
- pi-hole ftl, ftldns +1 morePi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration6.1 Medium
- runzero platformrunZero Platform incorrect credential scope5.8 Medium
- runzero explorer, platform +1 morerunZero Explorer missing authorization check4.4 Medium
- runzero platformrunZero Platform MCP endpoint information leak3.0 Low
- runzero platformrunZero Platform task information leak2.2 Low
- runzero platformrunZero Platform cleartext secret exposure5.3 Medium
- runzero platformrunZero Platform MCP certification information leak3.0 Low
- Show moreLoading…