CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- adobe dreamweaver, dreamweaver desktop +1 moreDreamweaver Desktop | Incorrect Authorization (CWE-863)6.3 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +5 more +7 more.NET SDK Elevation of Privilege Vulnerability7.8 High
- spring framework, vmware spring framework +1 moreSpring Framework Arbitrary Method Invocation in SpEL Expressions3.7 Low
- grokability snipe-itSnipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users7.1 High
- checkmkUser Messages widget leaked issuer messages on shared dashboards6.3 Medium
- symfony twigTwig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points7.1 High
- imagemagickImageMagick: Policy Bypass can read disallowed files5.5 Medium
- samsung internetImproper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to...6.3 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to...5.2 Medium
- dfir-iris iris-webIRIS Alerts Can be Falsely Attributed to Customers5.4 Medium
- openstack neutronOpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks2.2 Low
- lakshayd02 hostel-management-system-phpLakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization5.3 Medium
- better-auth better auth, better-auth +1 moreBetter Auth: Device authorization approve and deny accept any authenticated session while the user code is pending7.6 High
- mispMISP CRUDComponent delete validation bypass via operator precedence error7.9 High
- openstack mistral, red hat openstack platform 16.2 +1 moreOpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed9.9 Critical
- abb t-mac plusCommunication analysis between the Card Reader and TP2CardReaderService daemon7.2 High
- alf, alfio-event alf.io +1 morealf.io has an Authenticated RCE via Extension Script Sandbox Escape8.0 High
- danny-avila librechatLibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents5.7 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization5.3 Medium
- prefect, prefecthq prefecthq/prefect +1 moreAuthentication Bypass in prefecthq/prefect7.5 High
- revolution slider slider revolutionSlider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure4.3 Medium
- apache airflowApache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access3.1 Low
- astrbotdevs astrbotAstrBotDevs AstrBot fs.py _normalize_rw_path authorization5.3 Medium
- google androidIn multiple locations, there is a possible background activity launch due to a missing permission...7.8 High
- mervinpraison praisonai-platformPraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation9.4 Critical
- admidioAdmidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders8.1 High
- admidioAdmidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders6.5 Medium
- admidioAdmidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`6.5 Medium
github.com/metal3-io/cluster-api-provider-metal3GoCAPM3 vulnerable to Cross-Namespace resource access5.5 Medium- jetbrains teamcityIn JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups...4.3 Medium
- froxlorFroxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement8.6 High
- cliGitHub CLI tokens leak via `gh attestation` commands7.4 High
- openclawOpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route8.7 High
- openclawOpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes5.9 Medium
- openclawOpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks2.3 Low
- openclawOpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate2.3 Low
- openclawOpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command8.7 High
mautic/corePackagistMautic has an Authorization Bypass in API v2 Endpoints7.1 High- openstack neutronOpenStack Neutron has an Incorrect Authorization issue5.3 Medium
- oracle public sector financials, oracle corporation public sector financials (international) +1 moreVulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business...7.7 High
- always-further nononono: Sandbox escape on Linux via D-Bus: `systemd-run --user`6.1 Medium
- rustfsRustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source7.1 High
- projectcapsule capsuleCapsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability6.9 Medium
- openreplayCross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch5.3 Medium
- casdoorCVE-2026-90949.8 Critical
- apache artemis, apache software foundation activemq artemis stomp protocol, artemis stomp protocol +2 moreApache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission4.3 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morefanotify: fix false positive on permission events7.1 High
- gitlabIncorrect Authorization in GitLab4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak-rhel9: organization data leak after feature disabled in keycloak4.3 Medium
- Show moreLoading…