CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode6.5 Medium
- go-vikunja vikunjaVikunja 0.24.0 Broken Object Level Authorization via Link-Share Token9.3 Critical
- go-vikunja vikunjaVikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision8.6 High
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint7.5 High
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event5.4 Medium
- unknown simple restrictSimple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API2.7 Low
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes6.5 Medium
- openremoteopenremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks5.3 Medium
- zephyrproject zephyrBluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values6.5 Medium
- aws strands agents toolsIncorrect authorization in Strands Agents Tools http_request proxy credential exfiltration6.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes6.5 Medium
- joomsky js help deskJS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR4.3 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreBigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox5.7 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreAuthorization Bypass in MCP Toolbox Legacy HTTP Endpoints8.1 High
- drakkan sftpgoSFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation5.3 Medium
- projectcapsule capsuleCapsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)6.6 Medium
- opf openprojectOpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure4.3 Medium
- tigera calico, calico cloud, calico enterprise +2 moreCalico Tier Authorization Bypass via DeleteCollection6.2 Medium
- vendurehq vendureVendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update6.1 Medium
- kp4coder sync post with other siteSync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification6.5 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- olivetinOliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output4.3 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`6.5 Medium
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabIncorrect Authorization in GitLab5.3 Medium
- google google-adkGoogle-ADK Continuation Forgery9.3 Critical
- zitadelZITADEL Users Can Self-Verify Email/Phone via API8.2 High
- red hat quay 3.10, quay 3.12, quay 3.14 +5 more +7 moreQuay: quay: global read-only superuser can view robot account tokens7.2 High
- multiple open source open-iscsiiscsiuio control-socket authentication bypass in open-iscsi8.5 High
- holest spreadsheet price changer for woocommerce and wp e-commerce – lightSpreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation9.8 Critical
- apache traffic serverApache Traffic Server: Listener and ACL handling allow access-control bypass7.0 High
- apache traffic serverApache Traffic Server: URL and port parsing errors allow access-control bypass6.3 Medium
- goshs-labs goshsgoshs has ACL Bypass & Path Traversal5.3 Medium
- goshs-labs goshsgoshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)7.5 High
- adobe bridgeBridge | Incorrect Authorization (CWE-863)8.2 High
- adobe bridgeBridge | Incorrect Authorization (CWE-863)8.6 High
- ibm openbmc, power system e1050 \(9043-mrx\) firmware, power system e1150 \(9043-mru\) firmware +13 more +15 moreThis Power System update is being released to address incorrect authorization6.5 Medium
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 moreads-tec Industrial IT: Privilege escalation during configuration import8.7 High
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...7.1 High
- jfrog artifactoryIncorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation8.1 High
- devolutions serverImproper access control in the role membership management endpoint in Devolutions Server allows...8.8 High
- astrbotdevs astrbotAstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot astr_main_agent.py authorization5.3 Medium
- progress ecs connection manager, loadmaster, progress software moveit waf +3 more +5 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root8.0 High
- etcd-io etcdetcd: Watch API authorization bypass via open-ended range requests7.1 High
- cloudreveCloudreve before 4.17.0 SSRF via Admin.Read OAuth scope5.3 Medium
- vantage6vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review7.1 High
- cloudreveCloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored6.3 Medium
- budibase serverBudibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL8.3 High
- budibaseBudibase: Privilege escalation via public role assignment API missing app-level authorization8.8 High
- Show moreLoading…