CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- sailpoint identityiqIdentityIQ Role Editor Incorrect Authorization Vulnerability8.0 High
- corednsCoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison8.2 High
- openclawOpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP Tools2.3 Low
- openclawOpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions2.3 Low
- openclawOpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping6.3 Medium
- traefikTraefik Kubernetes CRD allows unauthorized cross-namespace middleware binding4.8 Medium
- newapi new api, quantumnous new-api +1 moreNew API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud7.1 High
- ericsson codecheckerAuthentication bypass for certain API calls9.3 Critical
- apache dolphinschedulerApache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.8.1 High
- getkirby kirbyKirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection7.1 High
- lightspeed classroomA client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated...5.4 Medium
- getkirby kirbyKirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter5.3 Medium
- openclawOpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions5.3 Medium
- openclawOpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route2.3 Low
- uutils coreutilsuutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership4.4 Medium
- gitlabIncorrect Authorization in GitLab2.7 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
@saltcorn/datanpm@saltcorn/data: Tenant user role is used for tenant creation role check8.7 High- openfga, openfga helm charts +1 moreOpenFGA has Improper Policy Enforcement5.0 Medium
- craigjbass clearancekitClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist8.4 High
- freescout-help-desk freescoutFreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes7.1 High
- freescout-help-desk freescoutFreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection7.1 High
- freescout-help-desk freescoutFreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads7.1 High
- octobercms octoberOctober: Editor Sub-Permission Bypass for Asset and Blueprint File Operations3.3 Low
- nvidia kai schedulerNVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper...4.3 Medium
- octobercms octoberOctober: Safe Mode Bypass via Twig Database Write Operations6.6 Medium
- octobercms octoberOctober: Safe Mode Bypass via CSS Preprocessor Compilers4.9 Medium
- openbaoOpenBao's Certificate Authentication Allows Token Renewal With Different Certificate2.0 Low
- difyDify has IDOR in deleting someone else's chat conversation5.3 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx-UI: Disabled users retain full API access through previously issued bearer tokens8.6 High
- fudo security enterprise, fudosecurity fudo enterprise +1 moreIncorrect authorization in Fudo Enterprise5.1 Medium
- sky co.,ltd. skymec it manager, skysea client view +1 moreSKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation...8.5 High
- apache airflowApache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to7.5 High
- leepeuker movaryMovary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts8.8 High
- openclawOpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing Store7.7 High
- openclawOpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads4.9 Medium
- openclawOpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution8.7 High
- openclawOpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools7.1 High
- openclawOpenClaw 2026.4.5 < 2026.4.10 - Sandbox Escape via host Parameter Override in Exec Routing8.7 High
- openclawOpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes6.0 Medium
- openclawOpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter7.1 High
- openclawOpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint7.1 High
- openclawOpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events9.1 Critical
- openclawOpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches7.6 High
- auth0 nextjs-auth0Auth0 Next.js SDK has Improper Proxy Cache Lookup5.4 Medium
- hkuds openharnessOpenHarness Permission Bypass via grep and glob root argument8.7 High
- better-auth, better-auth better-auth\/oauth-provider, oauth-provider +2 moreBetter Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients7.1 High
- kyvernoKyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)7.7 High
- @clerk nextjs, nuxt, shared +1 more +3 moreOfficial Clerk JavaScript SDKs: Middleware-based route protection bypass9.1 Critical
- netfoundry zrokzrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records5.3 Medium
- Show moreLoading…