CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- elastic kibanaImproper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure5.4 Medium
- elastic elasticsearchIncorrect Authorization in Elasticsearch Leading to Information Disclosure5.3 Medium
- elastic kibanaUnintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure4.3 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moreSQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox8.6 High
- saturday drive ninja formsNinja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action8.4 High
- libssh, red hat enterprise linux 10, enterprise linux 8 +11 more +13 moreLibssh: libssh: authentication bypass via missing gssapi principal check8.8 High
- vercel @ai-sdk/harness-codexAI SDK Codex Harness Tool Relay Authorization Bypass6.3 Medium
- vercel @ai-sdk/harness-opencodeAI SDK OpenCode Harness Tool Relay Authorization Bypass6.3 Medium
- surrealdbSurrealDB before 3.1.4 Array Element Permission Bypass7.1 High
- surrealdbSurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause5.3 Medium
- unknown all in one seoAll in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration2.7 Low
- linux, linux kernel +1 morenet: skmsg: preserve sg.copy across SG transforms9.4 Critical
- geex-arts django-jetgeex-arts django-jet OAuth Credential Revoke authorization6.9 Medium
- zevorn rt-clawzevorn rt-claw RPC swarm.c claw_tool_invoke authorization6.9 Medium
- sipeed picoclawSipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization5.3 Medium
- sipeed picoclawSipeed PicoClaw Group Message wecom.go dispatchIncoming authorization5.3 Medium
- falkordb queryweaverQueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts8.8 High
- zevorn rt-clawzevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorization6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization4.8 Medium
- surrealdbSurrealDB before 2.3.6 deny-net Bypass via DNS Resolution5.8 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization5.3 Medium
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Authorization Bypass Vulnerability8.3 High
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreIncorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access6.5 Medium
- matrix-org dendriteDendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure5.3 Medium
- osticketosTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure7.1 High
- mosaxiv clawletmosaxiv clawlet cron Chat Tool tool_cron.go remove authorization5.3 Medium
- getgrav grav-plugin-apiGrav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL8.1 High
- getgrav gravGrav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator8.6 High
- openclawOpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals7.7 High
- openclawOpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch2.3 Low
- openclaw msteamsOpenClaw MS Teams < 2026.5.12 Authorization Bypass2.3 Low
- openclawOpenClaw < 2026.5.18 Authorization Bypass via Device-pair7.7 High
- openclawOpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom2.3 Low
- openclawOpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs6.0 Medium
- openclawOpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals7.7 High
- openclawOpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch7.6 High
- openclawOpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron7.7 High
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION9.3 Critical
- arcadedata arcadedb, com.arcadedb arcadedb-server +1 moreArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read7.7 High
- arcadedata arcadedb, com.arcadedb arcadedb-engine +1 moreArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)8.1 High
- cert-managercert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials7.3 High
- axelor axelor-open-platformAxelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence8.7 High
- cyrusimap cyrus imapAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can...3.5 Low
- cyrusimap cyrus imapAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command...6.5 Medium
- cyrusimap cyrus imapAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature...5.4 Medium
- cyrusimap cyrus imapAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an...3.1 Low
- ciliumCilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match5.4 Medium
- @better-auth sso, better-auth, better-auth better auth +1 more +3 moreBetter Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso7.1 High
- immich-app immichimmich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser7.2 High
- Show moreLoading…