CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- docker sandboxesDocker Sandboxes read-only runtime mount writable through its shared-export alias5.7 Medium
- rustfsRustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback5.3 Medium
- rustfsRustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions8.1 High
- rustfsRustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions8.1 High
- rustfsRustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged7.5 High
- rustfsRustFS: Version-specific object reads authorize the non-version action6.5 Medium
- rapid7 velociraptorVelociraptor Hunt Deletion With Insufficient Permission Check6.5 Medium
- termly cookie consentCookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update4.3 Medium
- termly cookie consentCookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure4.3 Medium
- linuxvxlan: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreFreeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes8.2 High
- cisagov malcolmMalcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections7.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections7.0 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method2.3 Low
- cvat-ai cvatCVAT: Flawed authorization logic in endpoints related to lambda requests5.3 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.5 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.6 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)2.7 Low
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)6.5 Medium
- adobe commerce, commerce b2b, commerce and magento +3 more +5 moreAdobe Commerce | Incorrect Authorization (CWE-863)9.1 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- adobe lightroom, lightroom classic +1 moreLightroom Classic | Incorrect Authorization (CWE-863)7.7 High
- coturnCoturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific…5.8 Medium
- chocobozzz peertubePeerTube: Cross-origin remote video takeover via Update activity9.3 Critical
- microsoft .net framework, .net framework 3.5, .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 +6 more +8 more.NET Framework Elevation of Privilege Vulnerability8.8 High
- microsoft windows 11 version 26h1, windows 11 26h1 +1 moreWindows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability5.5 Medium
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Tampering Vulnerability6.5 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)8.8 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)7.3 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)6.5 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)9.6 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)7.8 High
- seaweedfsSeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths8.1 High
- rapid7 velociraptorVelociraptor query plugin allows impersonation in other orgs7.2 High
- commvault, commvault cloud +1 moreImproper Authorization Validation9.2 Critical
- commvault, commvault cloud +1 moreCommand Restriction Bypass9.2 Critical
- rapid7 velociraptorVelociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins4.1 Medium
- tp-link systems inc. eb210 pro(eu1) 1.0, eb210 pro(us1) 1.0, eb810v(eu1) v1.0 +56 more +58 morePrivilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices8.6 High
- cachethq cachetCachet 2.4.1 Authenticated Server-Side Template Injection RCE8.7 High
- dokployDokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632)9.9 Critical
- hashicorp vault, vault enterprise +1 moreVault vulnerable to LIST authorization bypass via trailing-slash strip4.3 Medium
- samsung healthIncorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access...6.9 Medium
- samsung healthIncorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access...6.9 Medium
- dotonpaper pinpoint booking systemPinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation5.3 Medium
- Show moreLoading…