CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- labring fastgptFastGPT: workflow runtime can execute another user's private HTTP toolset5.9 Medium
- frappe erpnextERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix8.8 High
- cloudreveCloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim7.6 High
- cloudreveCloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account root7.1 High
- labring fastgptFastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup7.7 High
- mervinpraison praisonaiPraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints7.1 High
- mervinpraison praisonaiPraisonAI before 1.6.78 Tool Approval Cache Bypass6.9 Medium
- zhinianboke xianyu-auto-replyzhinianboke xianyu-auto-reply Backend User Endpoint users authorization6.9 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)9.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)9.3 Critical
- czlonkowski n8n-mcpn8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode4.2 Medium
- fasterxml jackson-databindjackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization6.5 Medium
- adobe animate, animate 2023, animate 2024 +2 moreAnimate | Incorrect Authorization (CWE-863)8.1 High
- adobe animate, animate 2023, animate 2024 +2 moreAnimate | Incorrect Authorization (CWE-863)7.7 High
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.2 High
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Incorrect Authorization (CWE-863)5.9 Medium
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.6 High
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Incorrect Authorization (CWE-863)5.9 Medium
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Incorrect Authorization (CWE-863)6.8 Medium
- devolutions serverImproper authorization in the access request status endpoint in Devolutions Server 2026.2.11,...7.1 High
- rockwell automation studio 5000 logix designerStudio 5000 Logix Designer® – Multiple Vulnerabilities7.3 High
- kimaiKimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target6.3 Medium
- openclawOpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search5.3 Medium
- openclawOpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs8.7 High
- openclawOpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install6.9 Medium
- openclawOpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass7.2 High
- openclawOpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations7.1 High
- openclawOpenClaw < 2026.6.9 Authorization Bypass via flock wrapper8.7 High
- openclaw feishu, openclaw\/feishu +1 moreOpenClaw < 2026.6.9 Feishu Authorization Bypass8.6 High
- openclaw feishu, openclaw\/feishu +1 moreOpenClaw < 2026.6.9 Feishu tools Authorization Bypass8.6 High
- openclawOpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override7.2 High
- churchcrm crmChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII6.5 Medium
- decidimDecidim: JWT-backed authentication can be replayed across organizations8.5 High
- red hat openshift distributed tracing 3.10.1Tempo-operator: tempo operator: query rbac bypass6.5 Medium
- mattermost, mattermost server +1 moreUnauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost6.5 Medium
- will-moss isaiahwill-moss Isaiah Master Websocket server.go Server.Handle authorization6.9 Medium
- coollabsio coolifycoollabsio Coolify Policy Policies authorization5.3 Medium
- filebrowserFile Browser: Trailing-slash delete leaves a stale public share behind3.1 Low
- filebrowserfilebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete2.3 Low
- cap-go capgoCapgo - Scope Isolation Failure in Webhook Test Endpoint5.3 Medium
- mervinpraison praisonaiPraisonAI Platform before 0.1.9 Authorization Bypass via PATCH7.1 High
- genolve – genolve ai business graphics, ai imagesGenolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt8.8 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass7.0 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom7.0 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure4.9 Medium
- grokability snipe-itSnipe-IT: Import created_by can be overwritten5.7 Medium
- grokability snipe-itSnipe-IT: Incorrect permission for legacy license checkin API5.3 Medium
- grokability snipe-itSnipe-IT: Authorization bypass on print inventory page4.3 Medium
- windmill-labs windmillWindmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search5.1 Medium
- grokability snipe-itSnipe-IT: Authorization bypass on bulk editing users7.1 High
- Show moreLoading…