CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- sparx systems pro cloud serverBroken Access Control in Sparx Pro Cloud Server8.7 High
- hclsoftware connectionsHCL Connections is vulnerable to broken access control4.6 Medium
- budibaseBudibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows5.4 Medium
- mattermost, mattermost server +1 moreSlash command trigger-word update allowed command hijacking4.3 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks4.3 Medium
- mattermost, mattermost server +1 morePlaybooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update3.1 Low
- mattermost, mattermost server +1 moreIncomplete group locking implementation4.3 Medium
- mattermost, mattermost server +1 moreGroup prefix matching bypass for subscriptions4.3 Medium
- mattermost, mattermost server +1 moreInsufficient token rotation validation in remote cluster invite confirmation3.7 Low
- mattermost, mattermost server +1 moreInsufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed8.8 High
- openwebui open webui, open-webui +1 moreOpen WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)3.5 Low
- livehelperchatLive Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries8.1 High
- yordam information technology consulting, training and electronic systems industry and trade inc. library automation systemImproper Access Control in Yordam Informatics' Library Automation System8.8 High
- portainerPortainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization8.1 High
- portainerPortainer: Bind-mount restriction bypass via HostConfig.Mounts8.5 High
- wger-project wgerwger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API7.5 High
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreImproper authorization checks of team members privileges allow a team member to escalate...7.1 High
- mispMISP: Improper access control in auth key reset allows privilege escalation to site administrator8.6 High
- siyuan-note siyuanSiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata4.3 Medium
- gerritImproper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"6.0 Medium
- authlibAuthlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization6.1 Medium
- heymrun heymHeym < 0.0.21 Authorization Bypass in Workflow Execution7.6 High
- efwgrp efw4.xefw4.X: readonly Flag Not Enforced Server-Side8.1 High
- subnet solutions powersystem center 2020, powersystem center 2024, powersystem center 2026 +2 moreSubnet Solutions PowerSYSTEM Center Incorrect Authorization8.4 High
- subnet solutions powersystem center 2020Subnet Solutions PowerSYSTEM Center Incorrect Authorization6.9 Medium
- subnet solutions powersystem center 2024, powersystem center 2026 +1 moreSubnet Solutions PowerSYSTEM Center Incorrect Authorization7.0 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.5 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.5 High
- no-instructions relay-serverRelay Server WebSocket authentication bypass when token is omitted9.1 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Incorrect Authorization (CWE-863)9.3 Critical
- e-kalite software hardware engineering design and internet services industry and trade ltd. co. turboard for-sImproper Authorization in E-Kalite's Turboard FOR-S8.8 High
- dani-garcia vaultwardenVaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault8.1 High
- outlineOutline: Unauthorized Document Publication via Mixed collectionId+documentId Share6.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9...7.5 High
- apple ipados, macos, ios and ipados +1 more +3 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...7.8 High
- advplyr audiobookshelfAudiobookshelf: Collection endpoints bypass library access controls exposing restricted library data4.3 Medium
- advplyr audiobookshelfAudiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint6.5 Medium
- mantisbtMantisBT: Authorization Bypass in Bugnote Editing via Issue Update API5.3 Medium
- mantisbtMantisBT has an authorization bypass via private issue monitoring5.3 Medium
- ellanetworks coreElla Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse7.1 High
- wso2 identity server, conditional authentication user and roles related functions +1 moreAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover6.4 Medium
- wso2 identity server, carbon magiclink authenticator module +1 moreAccount Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access7.3 High
- hclsoftware bigfix webui, hcltech bigfix webui api, bigfix webui application administration +19 more +21 moreHCL BigFix WebUI is affected by an improper authorization vulnerability5.3 Medium
- free5gcfree5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions10.0 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: Open WebUI Improper Authorization Control7.3 High
- grokability snipe-itSnipe-IT: Privilege Escalation via API Permissions Assignment8.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO5.4 Medium
- Show moreLoading…