CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- phpipamphpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api...8.6 High
lemonldap-ngDebianLemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restric…6.5 Mediumjetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreTuxCare security update for 123 packages (8 CVEs)6.9 MediumjettyUbuntu,jetty12Debian,jetty9Debian +127 more +129 moreIn Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`,...8.8 Highjetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreUnauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring6.9 Medium- gerritIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review7.6 High
- botslab g980hBotslab G980H Dashcams Incorrect Authorization8.7 High
- bytebase dbhub@bytebase/dbhub's read-only mode does not prevent database writes7.4 High
- rmyndharis openwaOpenWA: VIEWER API keys can read WhatsApp group invite codes6.4 Medium
- goauthentik authentikauthentik: Privilege Escalation to Superuser via Group Hierarchy8.8 High
- tübitak ulakbim ulakpdfAdmin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF6.8 Medium
- tübitak ulakbim ulakpdfSAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF7.4 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations8.1 High
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab5.4 Medium
- bytedance coze scraper extensionByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization5.3 Medium
- abdurrab5 online-makeup-storeAbdurrab5 online-makeup-store Admin functions.php confirm_user authorization6.9 Medium
- klever-io klever-goKlever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller8.7 High
- gocdGoCD is vulnerable to authorization bypass via pipeline structure API4.3 Medium
- drupal mermaid diagram fieldMermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-1803.5 Low
- drupal webformWebform - Moderately critical - Access bypass - SA-CONTRIB-2026-1745.3 Medium
- drupal webformWebform - Less critical - Access bypass - SA-CONTRIB-2026-1734.3 Medium
- drupal webformWebform - Moderately critical - Access bypass - SA-CONTRIB-2026-1695.3 Medium
- drupal webformWebform - Moderately critical - Access bypass - SA-CONTRIB-2026-1683.3 Low
- drupal webformWebform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-1645.4 Medium
- moquetteMoquette fails open when configured authentication or authorization classes cannot load9.3 Critical
- moquetteMoquette client IDs can cause cross-session H2 durable-queue corruption8.8 High
- moquetteMoquette publishes Last-Will messages without enforcing write authorization8.7 High
- moquetteMoquette unbounded per-session message queues allow memory exhaustion8.7 High
- moquetteMoquette deeply nested MQTT topics can cause stack exhaustion8.7 High
- moquetteMoquette malformed shared subscriptions can crash command processing8.7 High
- moquetteMoquette uncaught MQTT command exceptions can terminate shared session event loops8.7 High
- moquetteMoquette pattern ACL wildcard injection allows cross-tenant authorization bypass9.6 Critical
- wp-graphqlWPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost5.4 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +15 more +17 moreSudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization7.8 High
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment3.7 Low
- stellarwp the events calendarThe Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes3.8 Low
- stellarwp the events calendarThe Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API2.7 Low
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing6.5 Medium
- openbaoOpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)6.0 Medium
- unleashUnleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log4.3 Medium
- dani-garcia vaultwardenVaultwarden through 1.37.3 Authorization Bypass via Missing Status Check8.6 High
- gardenerGardener: Authorization Bypass via Group Subject Injection5.5 Medium
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)10.0 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)8.3 High
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)9.1 Critical
- blakeblackshear frigateFrigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information7.7 High
- david-crty databasementDatabasement before 1.7.14 Authorization Bypass via Stale Invitation Token9.1 Critical
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass6.0 Medium
- Show moreLoading…