CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cloudreveCloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials7.1 High
- cloudreveCloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients4.3 Medium
- better-auth stripe@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription7.1 High
- red hat certificate system 10, certificate system 11, certificate system 9 +5 more +7 morePki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path3.1 Low
- easyappointments easy appointmentsEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion8.1 High
Magick.NET-Q16-AnyCPUNuGet,Magick.NET-Q16-arm64NuGet,Magick.NET-Q16-HDRI-AnyCPUNuGet +14 more +16 moreImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-492194.7 Medium- eclipse foundation basyx go componentsCWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components9.8 Critical
- casdoorCVE-2026-156309.9 Critical
- linux-gaming portprotonqtportprotonqt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager7.1 High
- jupyterlabJupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass6.0 Medium
- n8nn8n before 1.123.67 Credential Exfiltration via Sub-Workflow7.2 High
- n8nn8n before 1.123.67 Authentication Bypass via HTTP Request Node7.1 High
- n8nn8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes7.1 High
- n8nn8n before 2.32.1 Authentication Bypass via Token Exchange8.9 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moretlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse2.3 Low
- drupal webform restWebform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-0879.1 Critical
- traefikTraefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass5.3 Medium
- traefikTraefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef5.3 Medium
- n8nn8n before 1.123.64 Credential Exfiltration via GraphQL Node5.1 Medium
- n8nn8n before 2.30.1 Missing OAuth Authorization Check5.1 Medium
- n8nn8n before 2.30.1 Privilege Escalation via run_node_tool7.2 High
- elastic kibanaIncorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise4.3 Medium
- elastic kibanaIncomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery5.0 Medium
google.golang.org/grpcGo,rootio-google.golang.org/grpcRoot +1 moregRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities8.8 High- gitea open source git serverCross-Repo Information Disclosure via Org-Level Actions Run/Job APIs6.5 Medium
- gitea open source git serverPublic-only API token restriction is not enforced on team API routes4.3 Medium
- gitea open source git serverPrivate org member list leaked via /members API endpoint — incomplete fix for PR #381457.5 High
- oracle advanced benefitsVulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component:...7.6 High
- oracle time and laborVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component:...7.1 High
- oracle time and laborVulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component:...8.1 High
- oracle data integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component:...8.4 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web...9.9 Critical
- oracle data integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component:...7.8 High
- oracle data integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component:...7.5 High
- gitea open source git serverOAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)8.1 High
- shelf-nu shelf.nuShelf has cross-organization IDOR: authenticated users could read/attach another workspace's assets, tags, custodians, bookings, QR codes and audit data7.1 High
- gitea open source git serverREST API exposes organization membership of private organizations to public7.5 High
- gitea open source git serverFork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)7.1 High
- gitea open source git serverPersonal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents4.3 Medium
- gitea open source git serverPublic-only repository tokens can update private PR head branches9.1 Critical
- mediacmsMediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole8.2 High
code.gitea.io/giteaGoGitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions5.3 Medium- gitea open source git serverOAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)4.3 Medium
- gitea open source git serverToken public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #371189.6 Critical
- gitea open source git serverBranch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag8.1 High
- giteaGitea private repository metadata disclosure after access revocation4.3 Medium
- gitea open source git serverWebhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)6.8 Medium
- Show moreLoading…