CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- syliusSylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API8.2 High
- patriksimek vm2vm2 before 3.12.2 Authorization Bypass via Custom Resolver9.5 Critical
- coollabsio coolifycoollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization6.9 Medium
- kyvernoKyverno before 1.19.1 ImageValidatingPolicy Exception Bypass8.3 High
- budibase serverBudibase before 3.45.0 Information Disclosure via Chat Links8.3 High
- siyuan-note siyuanSiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations8.5 High
- cap-go capgo.appCapgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH7.0 High
- cap-go capgo.appcapgo.app before 12.128.12 Authentication Bypass via apikey8.7 High
- cap-go capgo.appCapgo Authentication Bypass via Direct PostgREST org_users Table Write8.7 High
- cap-go capgo.appcapgo.app Authentication Bypass via PostgREST customer_id Mutation7.0 High
- cap-go capgo.appcapgo.app Authorization Bypass via Stale Channel Permission Overrides6.0 Medium
- openclaw clawhubClawHub Authentication Bypass via Former Publisher Skill Control5.3 Medium
- openclawOpenClaw before 2026.7.1 Authorization Bypass via voice set5.3 Medium
- openclawOpenClaw before 2026.7.1 Sandbox Bypass via Browser Node8.7 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via node.invoke8.7 High
- openclaw feishu, googlechat, matrix +1 more +3 moreOpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass7.1 High
- openclaw lineOpenClaw LINE before 2026.8.1 Access Control Inheritance6.9 Medium
- openclawOpenClaw before 2026.8.1 Authorization Bypass via sessions.create5.3 Medium
- openclawOpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass7.7 High
- openclawOpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch8.7 High
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Session Reset5.3 Medium
- openclawOpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin5.3 Medium
- openclawOpenClaw before 2026.8.1 Policy Bypass via Native Tools8.7 High
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Access Group5.3 Medium
- openclawOpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation6.0 Medium
- openclaw feishuOpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account7.6 High
- openclawOpenClaw before 2026.8.1 Memory Access Control Bypass2.1 Low
- openclawOpenClaw before 2026.8.1 Local File Read via Outbound Attachments7.1 High
- openclawOpenClaw before 2026.8.1 Privilege Escalation via Session Memory7.7 High
- openclawOpenClaw before 2026.8.1 Exec Approval Directory Binding8.5 High
- openclawOpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer7.4 High
- google chromeIncorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote...6.3 Medium
- google chromeIncorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote...4.3 Medium
- google chromeIncorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a...4.4 Medium
- google chromeIncorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a...8.3 High
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote...5.4 Medium
- google chromeIncorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a...4.3 Medium
- google chromeIncorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote...3.1 Low
- google chromeIncorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...8.1 High
- google chromeIncorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed...2.9 Low
- google chromeIncorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote...4.8 Medium
- google chromeIncorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote...4.3 Medium
- actualbudget actualActual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token7.1 High
- invoiceplaneInvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade7.5 High
- zammadZammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data7.1 High
- zammadZammad: Incorrect Authorization and Improper Privilege Management8.7 High
- berriai litellmBerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer8.7 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request9.8 Critical
- stylemix masterstudy lmsMasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass4.2 Medium
- Show moreLoading…