CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- elastic kibanaIncorrect Authorization in Kibana Leading to Denial of Service4.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Privilege Escalation8.1 High
- thimpress learnpressLearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert5.3 Medium
- eclipse foundation arrowheadIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects...8.9 High
- n8nn8n before 2.36.2 Credential Exfiltration via Workflow Tool Node7.2 High
- dell powerprotect data managerDell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization...6.5 Medium
- cheshire-cat-ai coreCheshire Cat AI Memory Collection Endpoint Information Disclosure7.1 High
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints7.1 High
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions5.3 Medium
- drupal unpublished node permissionsUnpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-1325.3 Medium
- drupal jsonapi role accessJsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-1276.5 Medium
- grafana, grafana enterprise, oss +2 moreSession takeover via Auth Proxy cache key collision7.1 High
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Resource Consumption4.3 Medium
- elastic fleet serverIncorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations3.1 Low
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data5.4 Medium
- elastic cloud on kubernetes, eck operator +1 moreIncorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data5.4 Medium
- unknown wp edit password protectedWp Edit Password Protected < 1.3.5 - Protection Bypass via REST API5.3 Medium
- unknown passsterPassster < 4.2.26 - Global Protection Bypass5.3 Medium
- unknown passsterPassster < 4.2.24 - Password Protection Bypass5.3 Medium
- unknown restrict user accessRestrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization5.3 Medium
- unknown hipaa formsCM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass6.5 Medium
- kimaiKimai before 2.65.0 Authorization Bypass via API Timesheet5.3 Medium
- google chromeIncorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote...3.1 Low
- google chromeIncorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote...8.3 High
- google chromeIncorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75...8.1 High
- google chromeIncorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed...6.5 Medium
- google chromeIncorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote...3.1 Low
- google chromeIncorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote...9.6 Critical
- arubanetworks fabric composerAuthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API6.5 Medium
- arubanetworks fabric composerAuthenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer7.1 High
- arubanetworks fabric composerAuthenticated Privilege Escalation Leading to Unauthorized State Changes in HPE Networking Fabric Composer Web-Based Management Interface7.1 High
- arubanetworks fabric composerFault in Business Logic allows Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer8.3 High
- arubanetworks fabric composerAuthenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API8.5 High
- arubanetworks fabric composerAuthenticated Privilege Escalation Vulnerability in the API of HPE Networking Fabric Composer8.8 High
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data4.2 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring4.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Modification of Data5.4 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Privilege Escalation8.3 High
- grpc grpc-gogRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion6.3 Medium
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +9 more +11 moreDell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote...8.8 High
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via Bulk Restore5.3 Medium
- erlang otpinets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth6.0 Medium
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with...8.8 High
- pixarlabs master addons for elementor – elementor addons, widgets, mega menu builder, popup builder, widget builder & template kitsMaster Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction7.2 High
- ash-project ashAsh.Policy.Authorizer returns records denied by a runtime read policy to any actor5.9 Medium
- ash-project ashAsh relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records5.9 Medium
- ash-project ashAsh.Actions.Aggregate authorizes an aggregate under one action but computes it under another2.1 Low
- ash-project ash typescriptAuthorization-redacted field values disclosed through AshTypescript result normalization8.2 High
- google androidIn buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an...7.8 High
- Show moreLoading…