CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- hexpmOAuth token exchange grants repository scopes for organizations the principal cannot access8.3 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action5.3 Medium
- dolibarrDolibarr < 24.0.0 Users REST API SQL Injection via filter parameter7.1 High
- dolibarrDolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint7.2 High
- azuracastAzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass8.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreNetworkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)7.1 High
- bookstackapp bookstackBookStack < 26.05.4 Broken Access Control via Image Gallery API5.3 Medium
- kaon pg5298a, pg5298b +1 moreAuthenticated RCE in KAON PG52988.5 High
- pglombardo passwordpusherPasswordPusher before v2.9.6 Authentication Bypass via Null Comparison6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool6.9 Medium
- metaphor creations post duplicatorPost Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication4.3 Medium
- amazon freertos, freertos freertos-kernel +1 moreImproper input validation in FreeRTOS-Kernel timer command handling9.3 Critical
- lxc incusIncus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge9.9 Critical
- lxc incusIncus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`4.3 Medium
- spring ai, vmware spring ai +1 moreDefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection6.5 Medium
- unknown passsterContent Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass5.3 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount2.7 Low
- microsoft azure arcAzure Arc Elevation of Privilege Vulnerability10.0 Critical
- google chromeIncorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote...8.1 High
- wintercms winterWinter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate8.3 High
- laravel-backpack crudbackpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)7.6 High
- checkmk gmbh checkmkFrozen BI aggregations leak host and service names to unauthorized users2.3 Low
- frauscher sensortechnik fds 102Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control8.5 High
- ataur r gutenkitGutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure2.7 Low
- splunk ai toolkitImproper Privilege Management through Agent Run History in Splunk AI Toolkit8.3 High
- splunk soarInformation Disclosure through the REST API in Splunk SOAR4.3 Medium
- splunk, splunk enterprise +1 moreRisky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise5.4 Medium
- splunk, splunk enterprise +1 moreRisky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise5.4 Medium
- lemmynet lemmyLemmy: `CollectionAdd::Featured` does not check the post is in the community5.1 Medium
- ether etherpadEtherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint9.9 Critical
- wekanWekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule8.8 High
- ibm power systems firmware, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +17 more +19 morePower System Incorrect Authorization7.9 High
- akauntingAkaunting 3.1.21 - Improper authorization in BulkActions handle dispatch8.7 High
- ibm power systems firmware, power hardware management console \(7063-cr2\) firmware, power system ac922 \(8335-gth\) firmware +27 more +29 morePower System Incorrect Authorization8.1 High
- grokability snipe-itSnipe-IT: Tenant Isolation Bypass in FMCS Floater Mode7.6 High
- grafana enterprise, oss +1 moreCVE-2026-17183 CVE Record7.1 High
- rheosoph flow-likeFlow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users7.2 High
- wazuhWazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint8.2 High
- wazuhWazuh Manager dapi RBAC Bypass Allows Privilege Escalation7.7 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Authorization...5.5 Medium
- go-vikunja vikunjaVikunja through 2.4.0 Principal-Type Confusion via LinkSharing7.7 High
- apache tomcatApache Tomcat: Redirect after FORM auth may bypass method specific constraints9.1 Critical
- apache tomcatApache Tomcat: Bypass longest prefix security constraint9.1 Critical
- freebsdIncorrect user validation in ZFS_IOC_SET_PROP ioctl3.3 Low
- extra innovation inc. acmailer cgi, acmailer db +1 moreAn incorrect authorization vulnerability exists in acmailer, which may allow a user to create a...8.7 High
- cisagov malcolmImproper handling of highly compressed data (data amplification) in CISA Malcolm7.1 High
- cisagov malcolmIncorrect Authorization in CISA Malcolm5.3 Medium
- goauthentik authentikauthentik RAC: access any endpoint via an unrelated application8.8 High
- mybbMyBB: Insufficient permission check for calendar event move4.3 Medium
- mybbMyBB: Insufficient permission check for calendar select4.3 Medium
- Show moreLoading…