CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- grokability snipe-itSnipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation4.3 Medium
- free5gc smfSimple Machines Forum Authorization Bypass via AttachmentApprove.php7.1 High
- wekanWekan: Checklist direct DDP updates can write checklist data into private boards4.3 Medium
- decolua 9router9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass8.6 High
- mervinpraison praisonai-platformPraisonAI: Platform members can delete owner issue dependencies through member-owned related issues6.5 Medium
- mervinpraison praisonaiPraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies7.1 High
- phpmyfaqphpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints6.9 Medium
- flaskbbFlaskBB Authorization Bypass via Topic ID Manipulation7.2 High
- apache software foundation iotdbApache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users7.5 High
- zhayujie cowagentzhayujie CowAgent Message Endpoint channel.py authorization5.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication4.3 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'5.4 Medium
- sipeed picoclawSipeed PicoClaw pico.go rt.ReloadConfig authorization5.3 Medium
- sipeed picoclawSipeed PicoClaw MQTT Channel mqtt.go authorization5.3 Medium
- syliusSylius: Channel-based payment method restriction bypass on shop account orders API endpoint4.3 Medium
- avo-hq avoAvo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation3.1 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission4.3 Medium
- mispMISP: Improper sharing group authorization check when adding attributes5.3 Medium
- google chromeInappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote...8.8 High
- google chromeInappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote...8.8 High
- citeum openctiOpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS6.5 Medium
- citeum openctiOpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection7.1 High
- gitlabIncorrect Authorization in GitLab2.7 Low
- hashicorp nomad, nomad enterprise +1 moreNomad vulnerable to cross-namespace host volume claim deletion4.2 Medium
- linuxfoundation nats-serverNATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions5.4 Medium
- linuxfoundation nats-serverNATS Server: MQTT retained and QoS replay bypass subscribe deny filters4.3 Medium
- linuxfoundation nats-serverNATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)4.3 Medium
- linuxfoundation nats-serverNATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check5.3 Medium
- progress moveit transferCross-Org External Token Metadata accessible to AuditUser role2.7 Low
- blakeblackshear frigateFrigate viewer can read logs exposing admin and camera credentials8.1 High
- seaweedfsSeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets4.3 Medium
- cap-go capgoCapgo - Unauthorized Manifest Insertion via Read-Only Org Member7.1 High
- mispimportModule function in MISP ignores per-organisation import module restrictions5.3 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0...8.8 High
flask-security-tooPyPIFlask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion5.3 Medium- zhenorzz goployGoploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers9.6 Critical
- hasura graphql-engine, graphql engine +1 moreHasura: Row-level authorization bypass on table computed fields6.0 Medium
- better-auth oauth-provider@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass5.3 Medium
- dataeaseDataEase: Link Token Leakage Prior to Share Password/Ticket Validation8.7 High
- better-auth, better-auth better auth +1 moreBetter Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins9.1 Critical
- digi international one sp / sp ia / ia, portserver ts 1/2/4 +1 moreIncorrect Authorization5.9 Medium
- coollabsio coolifyCoolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution9.9 Critical
- fossbillingFOSSBilling: Unverified clients can access client-area pages when email confirmation is required5.3 Medium
- coderCoder: Workspace agent API insecure redirect handling allowed cross-agent file read and write8.3 High
- coderSuspended Coder users retain access to AI Bridge LLM proxy endpoints5.4 Medium
- coollabsio coolifyCoolify read-scoped API tokens can perform state-changing validation operations6.5 Medium
- fossbillingFOSSBilling missing authorization in guest Invoice API endpoints7.7 High
- Show moreLoading…