CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- okta access gatewayImproper Input Sanitization in Okta Access Gateway Protected Rules8.1 High
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Incorrect Authorization (CWE-863)9.9 Critical
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | Incorrect Authorization (CWE-863)8.6 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.6 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)7.5 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.2 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.6 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.7 High
- google androidIn multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of...8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Win32k Elevation of Privilege Vulnerability7.0 High
- n8nn8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution5.9 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreIncorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass7.0 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment7.6 High
- aircheng-org iwebshop-5aircheng-org iWebShop-5 update.php index authorization6.9 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreIncorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.05.3 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreIncorrect authorization in Credentials Manager in Guardian/CMC before 26.3.06.4 Medium
- xenforoXenForo < 2.3.13 Missing Authorization via force-agreement Controller5.1 Medium
- xenforoXenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher5.1 Medium
- xenforoXenForo < 2.3.13 MFA Bypass via Passkey TFA Provider7.6 High
- xenforoXenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass8.2 High
- knowns-dev knownsknowns before 0.30.0 Authorization Bypass via Misclassified Code Actions7.2 High
- knowns-dev knownsknowns before 0.30.0 Path Traversal via MCP doc and memory tools8.7 High
- laradashboardLara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload8.6 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources...7.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only...3.1 Low
- red hat directory server 11, directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8 +21 more +23 more389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn7.5 High
- strongswanstrongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins...7.1 High
- eclipse foundation ankaiosIn Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer...8.3 High
- projeto-siga sigaprojeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization6.9 Medium
- fluentcmsFluentCMS PermissionManager.cs GetAccessible authorization5.1 Medium
- getgrav grav-plugin-apiGrav API Plugin Authentication Bypass via Group-Inherited Super8.7 High
- ibm iIBM i is Affected By An Incorrect Authorization Vulnerability []4.3 Medium
- ibm observability with instana (agent)IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image7.7 High
- documensoDocumenso 2.17.0 PDF Route Ignores Document Visibility7.1 High
- appflowy-io appflowy-cloudAppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket6.0 Medium
- crystaldba postgres-mcpPostgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function9.2 Critical
- appflowy-io appflowy-cloudAppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API7.7 High
- traefikTraefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict8.2 High
- thorsten phpmyfaqphpMyFAQ before 4.1.8 Authorization Bypass via question/create6.3 Medium
- thorsten phpmyfaqphpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages5.3 Medium
- google cloud integration connectorsImproper Authorization in Google Cloud Integration Connectors Leads to Project Takeover8.5 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System session.php authorization6.9 Medium
- mispMISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes8.3 High
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms5.3 Medium
- elastic kibanaIncorrect Authorization in Kibana Leading to Unauthorized Configuration Modification8.1 High
- elastic kibanaIncorrect Authorization in Kibana Leading to Information Disclosure6.5 Medium
- Show moreLoading…