CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cisco identity services engine softwareISE information disclosure4.9 Medium
- zalando skipperSkipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)7.5 High
- changeweder crmChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization5.3 Medium
- openfgaOpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that…5.3 Medium
- jenkins project pipeline: multibranch pluginJenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate...3.1 Low
- arista networks eosSecurity Advisory 01766.9 Medium
- arista networks eosSecurity Advisory 01702.3 Low
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreUnauthorized IODD File Upload due to Improper Authorization8.1 High
- gitlabIncorrect Authorization in GitLab8.5 High
- arista networks eosSecurity Advisory 01607.0 High
- netcore nr255-vNetcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes5.3 Medium
@zereight/mcp-gitlabnpm@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS8.1 High- google chromeIncorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote...8.3 High
- google chromeIncorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a...7.4 High
- oracle hyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion ...7.6 High
- oracle hyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion ...7.7 High
- oracle hyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion ...7.6 High
- devolutions serverServer-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server...6.5 Medium
- gitlabIncorrect Authorization in GitLab7.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Broken Object-Level Authorization via task-position5.3 Medium
- go-vikunja vikunjaVikunja before 2.6.0 API Token Scope Bypass via expand Parameter5.3 Medium
- go-vikunja vikunjaVikunja before 2.6.0 User Enumeration via v2 API5.3 Medium
- openbmc phosphor-net-ipmidOpenBMC IPMI Privilege Escalation via Retargeted RAKP 18.8 High
- casdoorCasdoor through 4.4.0 Cross-Organization User Administration via /api/mcp9.4 Critical
- mispMISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison5.3 Medium
- octopus deploy serverIn affected versions of Octopus Server, users with certain scoped permission sets could execute...7.2 High
- No product listedSmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This...9.8 Critical
- No product listedAn issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the...8.8 High
- mattermost, mattermost server +1 moreData Retention Teams Endpoint Leaks Private Team Invite ID6.5 Medium
- apple macos, xcode +1 moreA permissions issue was addressed with improved validation. This issue is fixed in Xcode 27,...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreAn authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7...5.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple ipados, macos, tvos +2 more +4 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macosA permissions issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and...5.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...7.5 High
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Golden...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macosAn issue existed in the handling of snapshots. The issue was resolved with improved permissions...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved access control. This issue is fixed in iOS 26...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...6.1 Medium
- a2aproject a2a-javaa2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization5.3 Medium
- fedora, red hat enterprise linux 10, enterprise linux 6 +3 more +5 morePackageKit: dnf5 backend ignores SIMULATE on RepoRemove7.1 High
- casdoorCasdoor through 4.4.0 Private Key Exposure via Certificate Endpoints9.3 Critical
- djangocrm django-crmDjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization5.3 Medium
- apache software foundation storm clientApache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users9.8 Critical
- apache software foundation storm nimbusApache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides8.1 High
- Show moreLoading…