CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- canonical lxdLXD Snapshot Import Privilege Escalation Vulnerability7.2 High
- netflix lemurLemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership6.3 Medium
- netflix lemurLemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission8.8 High
- tooljetToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets6.8 Medium
- outlineAuthorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy5.3 Medium
- gitlabIncorrect Authorization in GitLab3.8 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gogsGogs: Authorization Bypass in Watch API allows any user to monitor private repository activity4.3 Medium
- drupal commerce realex / global payments, stella commerce realex \/ global payments +1 moreCommerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-0584.8 Medium
- drupal ai agents, artificial intelligence project intelligence +1 moreAI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-0574.8 Medium
- anuaralfetahe advanced content feedback, drupal advanced content feedback (aka admin feedback) +1 moreAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-0523.1 Low
- linux, linux kernel +1 moreppp: require CAP_NET_ADMIN in target netns for unattached ioctls8.8 High
- bytecodealliance wasmtimeWasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination6.5 Medium
- cap-go capgoCapgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header8.7 High
- grokability snipe-itSnipe-IT: 2FA reset privilege bypass5.8 Medium
- grokability snipe-itSnipe-IT: User Account Escalation via CSV Import6.5 Medium
- grokability snipe-itSnipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment5.5 Medium
- fasterxml jackson-databindjackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind6.5 Medium
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)8.1 High
- fasterxml jackson-databindjackson-databind: @JsonView bypass for setterless creator properties5.3 Medium
- fossbillingFOSSBilling: Broken Authorization in Client Transaction and Order Listings7.1 High
- rtk-ai rtkrtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators7.8 High
- daytonaio daytonaDaytona: Cross-tenant organization takeover via invitation acceptance with an unverified email8.4 High
- gogsGogs: Write-level collaborators can mutate admin-only repository settings via API7.1 High
- nanocoai nanoclawNanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback5.3 Medium
- fossbillingFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions10.0 Critical
- presire qsnapperCaching of Authentication allows Authentication Bypass between users in qSnapper8.4 High
- presire qsnapperCaching of Authentication allows Authentication Bypass in qSnapper8.4 High
- presire qsnapperInformation leak via “diff” methods in qSnapper6.9 Medium
- mattermost, mattermost server +1 moreUser Manager can demote bot accounts to guest without bot-management permission3.8 Low
- mattermost, mattermost server +1 moreImproper Permission Check Allows User Manager to Deactivate Bot Accounts3.8 Low
- mispBroken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models7.1 High
- apache nifiApache NiFi: Incorrect Authorization for Configuration Verification Requests2.3 Low
- berriai litellmBerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization5.3 Medium
- surrealdbSurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal5.3 Medium
- surrealdbSurrealDB < 3.1.5 Information Disclosure via ORDER BY5.3 Medium
- eidetic-labs stigmem-nodestigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep7.2 High
- eidetic-labs stigmem-nodestigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine8.6 High
- authzed spicedbSpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected3.7 Low
- openbaoOpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-458082.1 Low
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 moreAuthentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities7.5 High
- autheliaAuthelia has an Edge Case Access Control Rule Mismatch1.3 Low
- proxysqlProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL10.0 Critical
- statamic cmsStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources4.3 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreip6_vti: set netns_immutable on the fallback device.7.8 High
- apache apisixApache APISIX: authz-casdoor incorrect session sharing5.3 Medium
- open-telemetry github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver, opentelemetry-collector-contrib +1 moreOpenTelemetry githubreceiver silently ignores configured required_headers authentication6.9 Medium
- mervinpraison praisonaiPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml7.8 High
- Show moreLoading…