CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- 9001 copypartyCopyparty: file/dirkey confusion4.3 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Incorrect Authorization via Publish Access8.7 High
- mattermost, mattermost server +1 moreMattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels6.5 Medium
- mattermost, mattermost server +1 moreInsufficient server-side validation of board member role fields permits privilege escalation8.3 High
- onyx-dot-app onyxOnyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers9.6 Critical
- grafana oss, enterprise +1 moreCVE-2026-11817 CVE Record5.3 Medium
- typemillTypemill < 2.26.0 Authorization Bypass via Media File Download Route8.7 High
- jumpserverJumpServer: Privilege Overwrite via Organization Invite Logic Flaw6.2 Medium
- volcengine openvikingOpenViking Debug Vector Endpoints Multi-tenant Data Exposure7.1 High
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +9 more +11 moreMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters9.9 Critical
- mattermost, mattermost server +1 moreBoards plugin retains Board Admin rights for users demoted to System Guest6.3 Medium
- mattermost, mattermost server +1 moreMissing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal4.2 Medium
- mattermost, mattermost server +1 moreInsufficient validation of guest board admin privileges on archive import3.9 Low
- mattermost, mattermost server +1 moreDelegated OAuth tokens could revoke unrelated OAuth application authorizations2.7 Low
- mattermost, mattermost server +1 moreMissing run-state validation on finished playbook runs3.5 Low
- mattermost, mattermost server +1 moreChannel member roles accept out-of-scope roles6.3 Medium
- kong inc. meshKong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier7.0 High
- stoatchatstoatchat before 0.15.0 Permission Bypass via message_fetch7.1 High
- themeisle visualizerVisualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure6.5 Medium
- sc0ttkclark pods – custom content types and fieldsPods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router9.8 Critical
- openstack octaviaOpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By...4.3 Medium
- tenable security centerPrivilege Escalation8.6 High
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks6.9 Medium
- getgrav grav, grav-plugin-flex-objects +1 moreGrav through 2.0.11 Authentication Bypass via Flex Objects8.7 High
- openchoreoOpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints8.8 High
- elastic kibanaIncorrect Authorization in Kibana Fleet Leading to Privilege Escalation7.1 High
- elastic kibanaIncorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents7.1 High
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations5.4 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data7.7 High
- zimbra collaboration, synacor zimbra collaboration suite +1 moreAn authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to...3.1 Low
- rsyncproject rsyncrsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure9.1 Critical
- rsyncproject rsyncrsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing8.6 High
- rsyncproject rsyncrsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getRefIDs6.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Header Predicate Bypass in WebFlux Functional Endpoints9.8 Critical
- openstack horizon, the opennms group meridian +1 moreOpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only4.3 Medium
- openstack designateIn OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the...9.6 Critical
- canonical lxdProject restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`4.3 Medium
- canonical lxdProject restriction bypass via instance migration config override9.9 Critical
- canonical lxdCross-project instance copy bypasses target project restrictions via TOCTOU in config merge9.9 Critical
- canonical lxdCross-project cluster migration bypasses project restrictions via cluster notification flag9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Tag API6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via UILayout Filter6.9 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab8.5 High
- drupal quick tabs, quick tabs project tabs +1 moreQuick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-0995.3 Medium
- diff project diffDiff - Moderately critical - Access bypass - SA-CONTRIB-2026-0965.3 Medium
- centarro commerce paypalCommerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-0959.1 Critical
- jfrog artifactoryBundle writers may alter trusted release information in JFrog Artifactory4.3 Medium
- Show moreLoading…