CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- coderCoder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator8.2 High
- ciliumCiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation6.9 Medium
- traefikTraefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port6.3 Medium
- devolutions serverImproper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026...8.8 High
- nextlevelbuilder goclawnextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization5.3 Medium
- gitea open source git serverPermanent Fork PR Workflow Approval Gate Bypass8.9 High
- gitea open source git serverGitea LFS object reuse bypasses Code-unit authorization7.1 High
- gitea open source git serverGitea pre-receive hook can miss branch-protection checks after scanner errors9.8 Critical
- gitea open source git serverGitea pre-receive hook permission cache allows full repository write access8.8 High
- gitea open source git serverGitea repository feeds bypass API token scope enforcement4.3 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...4.2 Medium
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Elevation of Privilege Vulnerability8.8 High
- ubiquiti inc unifi network applicationA malicious actor with access to the network and under certain conditions could exploit an...7.5 High
- progress flowmonUnintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon8.7 High
- github enterprise serverAn incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories5.3 Medium
- suse rancher, rancher fleet +1 moreRancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer9.9 Critical
- surrealdbSurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted5.4 Medium
- surrealdbSurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT5.3 Medium
- surrealdbSurrealDB before 3.1.0 Authentication Bypass via USE statement6.9 Medium
- surrealdbSurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT5.3 Medium
- surrealdbSurrealDB before 3.1.0 Field Permission Bypass via JSON Patch5.3 Medium
- surrealdbSurrealDB before 3.1.0 Authorization Bypass via Composite Record-id5.3 Medium
- surrealdbSurrealDB before 3.1.0 Permission Bypass via Graph Traversal7.1 High
- surrealdbSurrealDB before 3.1.0 Permission Bypass via WHERE Clause7.1 High
- crateCrateDB's Blob HTTP handler bypasses authorization7.1 High
- symfony twigTwig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`6.0 Medium
- elastic kibana, endpoint security +1 moreIncorrect Authorization in Kibana Leading to Information Disclosure5.3 Medium
- mycomplianceoffice mco, mycomplianceoffice +1 moreUnauthorized Access to Administrator ACL View in MCO5.3 Medium
- mycomplianceoffice mco, mycomplianceoffice +1 morePrivilege Escalation in MCO7.1 High
- onionshareOnionShare Receive mode writes uploaded files even when file uploads are disabled5.4 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass9.1 Critical
- symfony twigTwig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`6.0 Medium
- symfony twigTwig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters7.1 High
- symfony twigTwig: Sandbox `__toString()` policy bypass via dynamic mapping keys7.1 High
- cedar-policy authorization-for-expressjs@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation8.8 High
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- its-a-feature mythicMythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint5.3 Medium
- its-a-feature mythicMythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table7.1 High
- yunai ruoyi-vue-proruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController8.6 High
- khoj-ai khojkhoj-ai khoj Conversation Sharing api_chat.py authorization5.1 Medium
- lfprojects mlflowMLflow Experiment-scoped Label Schema CRUD API authorization2.3 Low
- rustdeskRustDesk - FileTransfer Session Authorization Scope Bypass7.2 High
- statamic cmsStatamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors3.5 Low
github.com/blnkfinance/blnkGoBlnk has an API key authorization bypass in owner and scope enforcementNo score- kestraKestra: Cross-Execution File Read via Preview Endpoint (IDOR)6.5 Medium
- fleetdm fleetFleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint4.3 Medium
- rustfsRustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials8.2 High
- rustfsRustFS: FTP frontend skips IAM authorization on object reads7.7 High
- opf openprojectOpenProject: Shares API Information Disclosure6.5 Medium
- opf openprojectOpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects5.4 Medium
- Show moreLoading…