CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- etoilewebdesign ultimate product catalogWordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE8.7 High
- wertheim gmbh safecontroller software for vault rooms (safe deposit locker system)Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions7.1 High
- softaculous page builder: pagelayer – drag and drop website builderPagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'4.3 Medium
- openclawOpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings2.3 Low
- openclawOpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands8.2 High
- openclawQQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Command7.4 High
- openclawOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration7.4 High
- openclawOpenClaw < 2026.5.18 - Command Truncation in Exec Approval Display8.5 High
- openclawOpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement7.7 High
- openclawOpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket8.7 High
- filebrowserFile Browser: Incorrect access control in public directory shares via rule path rebasing7.5 High
- mispMISP object edit authorization bypass allows unauthorized sharing group assignment5.3 Medium
- filebrowserFile Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path8.4 High
- nezhahq nezhaNezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context6.4 Medium
- mispMISP event editing allows unauthorized assignment to undisclosed sharing groups6.1 Medium
- mispMISP template builder exposes non-visible custom galaxies across organisations5.3 Medium
- mispMISP organization administrators can target site administrator accounts for password reset7.5 High
- mispMISP improper authorization allows organization administrators to modify site administrator user settings5.1 Medium
- actualbudget actualActual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`6.9 Medium
- parse-community parse-serverParse Server: Server option routeAllowList is bypassable through batch sub-requests6.9 Medium
- solidtime-io solidtimeSolidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permission4.3 Medium
- mattermost, mattermost server +1 moreMattermost group syncable endpoints allow privilege escalation via scheme_admin8.8 High
- mattermost, mattermost server +1 moreMattermost: Delegated admins could patch protected default system roles6.7 Medium
- jpillora chiselChisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection8.5 High
- chroma chromadbChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to8.8 High
- @clerk nuxtNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher8.8 High
- duck-organization questbotQuest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.7.1 High
- macwarrior clipbucket-v5ClipBucket: IDOR in videos subtitle editor6.5 Medium
- l3montree-dev devguardDevGuard has improper authorization on public assets7.1 High
- openclawOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing8.7 High
- openclawOpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node8.6 High
- openclawOpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy4.8 Medium
- openclawOpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply Flow6.0 Medium
- openclawOpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom7.7 High
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabIncorrect Authorization in GitLab5.4 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)6.0 Medium
- inisev copy & delete postsCopy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling Handler7.2 High
- fissionFission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook8.5 High
- fissionFission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook7.7 High
- erlang otp, erlang\/otp, erlang\/ssl +2 moreDistribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist7.5 High
- roxy-wiRoxy-WI: IDOR — any authenticated user can read another user's full action history4.3 Medium
- roxy-wiRoxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body9.1 Critical
- roxy-wiRoxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host8.5 High
- roxy-wiRoxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server9.9 Critical
- nezhahq nezhaNezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data5.3 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 56.2 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)8.4 High
- Show moreLoading…