CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn multiple locations, there is a possible unauthorized URI access due to a permissions bypass....7.8 High
- suluSulu: Media move/update authorization bypass (IDOR)5.3 Medium
- suluSulu: Fix authorization bypass when creating preview links5.3 Medium
- easycorp easyadminbundleEasyAdmin custom-action dispatcher bypasses access_control on other routes8.1 High
- ellite wallosWallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh4.3 Medium
- mcphubMCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching8.1 High
- dataeaseDataEase before 2.10.26 Access Control Bypass via Share Tickets5.3 Medium
- tooljetToolJet before v3.16.208 Authorization Bypass via organizationId5.1 Medium
- growi, inc. growiGROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an...6.9 Medium
- ash-project ash phoenixBroken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain7.6 High
- ash-project ash graphqlCross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read7.1 High
- ash-project ash graphqlBroken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification2.3 Low
- elated-themes frappeFrappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint7.1 High
- ash-project ash sqlexists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql5.9 Medium
- ash-project ash sqlSame-named aggregates with differing filters are conflated in AshSql2.1 Low
- ash-project ash sqlDistinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql2.1 Low
- pac4jpac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check8.6 High
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability4.9 Medium
- unknown booking for appointments and events calendarAmelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval2.7 Low
- piccolo-orm piccolo adminPiccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.8.8 High
- microsoft edge (chromium-based), edge chromium, edge for android +4 more +6 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability5.4 Medium
- go-vikunja vikunjaVikunja: Project duplication bypasses write-permission check on the target parent project5.3 Medium
- immich-app immichImmich Locked Assets Remain Readable Through Albums and Shared Links7.1 High
- golang.org/x/crypto golang.org/x/crypto/sshSource-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh7.5 High
- eclipse foundation lyo, the eclipse foundation eclipse lyo +1 moreOAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default9.1 Critical
- wazuhWazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key7.0 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion7.1 High
- triliumnext triliumTrilium unauthenticated share-search discloses password-protected and hidden shared notes7.5 High
- fonosterFonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler5.3 Medium
- unknown jetbackupJetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download4.4 Medium
- spring security, vmware spring security +1 moreSpring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces9.4 Critical
- seaweedfsSeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename7.1 High
- free5gc smfSimple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()8.6 High
- seaweedfsSeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite8.1 High
- seaweedfsSeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy8.7 High
- weblateorg weblateWeblate: Object-scoped RSS feeds disclose private change history to unauthorized users5.3 Medium
- elated-themes frappeFrappe: Access control bypass via REST API dot-notation fields on linked doctypes7.1 High
- drupal entity api, entity api project api +1 moreEntity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-1135.3 Medium
- blazy project blazyBlazy - Less critical - Access bypass - SA-CONTRIB-2026-1045.3 Medium
- spring security, vmware spring security +1 moreWebAuthn User Verification Bypass via Session Serialization7.4 High
- openzfsOpenZFS: user-namespace capability check allows unprivileged local authorization bypass7.3 High
- getgrav gravGrav before 1.0.18 Authentication Bypass via Scoped API Key9.3 Critical
- getgrav gravGrav before 1.0.18 Authentication Bypass via Scoped API Key9.3 Critical
- openstack keystoneIn OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms ...7.6 High
- openstack keystoneIn OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application...7.6 High
- google chromeIncorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeIncorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65...9.8 Critical
- google chromeIncorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed...4.3 Medium
- google chromeIncorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a...6.5 Medium
- Show moreLoading…