CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- fleetdm fleetFleet before 4.89.0 Information Disclosure via MDM Command Results5.3 Medium
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials8.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to...7.1 High
- hitachi industrial equipment systems coding software suiteImproper authorization may allow a general user to perform operations equivalent to those available with administrator privileges8.7 High
- octopus deploy serverIn affected versions of Octopus Server, users with certain scoped permission sets could execute...7.1 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Incorrect Authorization4.3 Medium
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Incorrect Authorization6.5 Medium
- openbsdIn ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication...9.2 Critical
- openclaw windows nodeOpenClaw Windows Node before 2026.7.1 Authorization Bypass8.7 High
- embysupport securitySoft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token9.0 Critical
- nvidia geforce, rtx, quadro, nvs, tesla +1 more +3 moreNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an...7.8 High
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 moreNVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling...7.8 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide...4.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a...8.9 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility...5.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed...8.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose...3.3 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only...7.6 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by...4.3 Medium
- mlogclub bbs-gobbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount5.3 Medium
- grafana enterprise, oss +1 moreAlert rules in restricted folders disclosed via the alert rules list API4.3 Medium
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a...8.8 High
- watchguard fireware, fireware os +1 moreFireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access7.2 High
- grafana enterprise, oss +1 moreLibrary panel can be moved into a folder without library panel create permission4.3 Medium
- google chromeIncorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed...7.5 High
- liberu software crmLiberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()8.7 High
- openclawOpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket6.0 Medium
- openclawOpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines6.0 Medium
- ollamaOllama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization8.5 High
- pardus pardus-parental-controlPardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py6.8 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints4.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions4.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure6.5 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths5.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- No product listedREBUILD file-editor-save authorization6.9 Medium
- nginxproxymanager nginx-proxy-managerNginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config7.1 High
- zoneminderZoneMinder before 1.38.4 Incorrect Authorization in frames API index5.3 Medium
- invoiceplaneInvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)7.0 High
- invoiceplaneInvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery8.7 High
- grpc grpc-node@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches6.5 Medium
- webkul bagistoWebkul Bagisto Invoice Mass Status Update state authorization5.1 Medium
- watchguard apWatchGuard AP Command Injection in Internal Management API Allows Command Execution9.3 Critical
- canonical lxdIncorrect authorization in LXD storage volume API allows reading volumes from other projects7.7 High
- google cloud application integrationIncorrect Authorization in Application Integration allows Internal Stubby RPC Execution9.4 Critical
- apache software foundation rollerApache Roller: OAuth authorization endpoint trusts request-supplied identity9.0 Critical
- bradwenqiang hrFrappe HR Permission Validation __init__.py get_attendance_requests authorization5.3 Medium
- netcore nbr100v2Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization10.0 Critical
- zhistaredu startrainingzhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization5.3 Medium
- Show moreLoading…