CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost, mattermost server +1 moreMattermost ABAC parent policy bypass via policy update endpoint5.5 Medium
- apache software foundation syncopeApache Syncope: Cross-Realm authorization bypass in delegated administration7.5 High
- apache software foundation syncopeApache Syncope: Cross-Realm boundaries reconciliation bypass9.8 Critical
- apache software foundation syncopeApache Syncope: Non-recursive Any search could skip Realms restrictions9.8 Critical
- apache software foundation syncopeApache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values9.8 Critical
- espocrmEspoCRM before 10.0.4 Field-level Security Bypass via Attendees8.7 High
- filebrowserFile Browser 2.5.0 Directory Deletion via Upload Failure Cleanup7.2 High
- apache software foundation syncopeApache Syncope: ClientApp update entitlement not effective9.8 Critical
- ping identity pingfederateImproper Authorization in PingFederate Administrative Expression Evaluation Endpoint8.5 High
- apache software foundation dorisApache Doris: Authorization bypass leading to unauthorized data access6.5 Medium
- apache software foundation dorisApache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables8.8 High
- typo3 femanagerAn issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module...5.4 Medium
- wxiaoqi spring-cloud-platformwxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization5.3 Medium
- wxiaoqi spring-cloud-platformwxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization5.3 Medium
- chengdu qilu technology ludashiChengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization4.6 Medium
- jowilf starlette-adminstarlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass5.3 Medium
- cisa malcolmIncorrect Authorization in Malcolm5.3 Medium
- openstack keystoneAn issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated...7.6 High
- dolibarrDolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php8.7 High
- forgejoForgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow...3.5 Low
- concrete cms cmsConcrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.6.3 Medium
- @jhb.software payload-alt-text-plugin, jhb-software payload-plugins +1 more@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission7.1 High
- ibm app connect enterpriseIBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service8.8 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards9.8 Critical
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to an authorization bypass in the catalog deregistration path5.4 Medium
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to an authorization bypass in the catalog node-write path8.3 High
- rclonerclone: RC per-server auth-proxy bypass9.1 Critical
- knowns-dev knownsknowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint6.9 Medium
- knowns-dev knownsknowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption8.7 High
- traefikTraefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization7.0 High
- traefikTraefik HTTP/3 Backend NTLM Connection Reuse9.1 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: Users denied by the OAuth role policy can still sign in via token exchange6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange6.5 Medium
- grokability snipe-itSnipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout5.3 Medium
- mend mend-renovate-ce, mend-renovate-enterprise-edition, renovate-ce +3 more +5 moreRenovate before 44.3.1 Authentication Bypass via Digest Updates6.9 Medium
- cap-go capgo.appCapgo API Key Manager Authentication Bypass via x-limited-key-id8.7 High
- cap-go capgo.appCapgo Authorization Bypass via Stale Channel Permission Overrides9.3 Critical
- countly countly-serverAn authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub...7.1 High
- unknown notiqooNotiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes6.5 Medium
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and...3.5 Low
- grokability snipe-itSnipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints5.3 Medium
- grokability snipe-itsnipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag5.3 Medium
- grokability snipe-itSnipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth5.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via OAuth Clients8.5 High
- grokability snipe-itsnipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint5.3 Medium
- grokability snipe-itsnipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints5.3 Medium
- grokability snipe-itsnipe-it before 8.7.0 Authorization Bypass via API User Create/Update8.3 High
- Show moreLoading…