CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeIncorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...6.1 Medium
- google chromeIncorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...6.5 Medium
- google chromeIncorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...6.5 Medium
- google chromeIncorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote...8.8 High
- google chromeIncorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a...9.6 Critical
- google chromeIncorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed...5.1 Medium
- google chromeIncorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39...6.1 Medium
- google chromeIncorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...5.9 Medium
- google chromeIncorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote...9.6 Critical
- google chromeIncorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote...5.3 Medium
- google chromeIncorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...6.1 Medium
- google chromeIncorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote...9.6 Critical
- @payloadcms plugin-multi-tenant, payloadcms payload +1 morePayload: Cross-tenant create in @payloadcms/plugin-multi-tenant5.3 Medium
- payloadcms payloadPayload: Field access control bypass on auth collections9.3 Critical
- payloadcms payloadPayload: Sort queries could expose protected field information6.9 Medium
- microsoft simplechatSimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)8.8 High
- unknown elegro crypto paymentelegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback6.5 Medium
- phpgurukul user registration & login and user management systemPHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization5.1 Medium
- laurent22 joplinJoplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier8.5 High
- docling, docling-project docling-slim +1 moreDocling: `enable_local_fetch` is not enforced in HTML browser-rendering mode5.9 Medium
- red hat quay 3Quay: quay: global read-only superuser can access build trigger write credentials5.5 Medium
- camunda 7Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint9.2 Critical
- penpotPenpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection4.9 Medium
- penpotPenpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope4.3 Medium
- makeplane planePlane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance8.2 High
- rapid7 velociraptorVelociraptor Server Metadata update with Insufficient Permission Check6.5 Medium
- makeplane planePlane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member4.3 Medium
- makeplane planePlane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access5.4 Medium
- @insumermodel mppx-condition-gate, mppx-token-gate +1 moremppx-condition-gate: Free-access path grants on a self-declared wallet without proving control7.5 High
- zitadelZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service5.3 Medium
- mayswind ezbookkeepingmayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint5.3 Medium
- laradashboardLaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API7.1 High
- legion of the bouncy castle inc. bc-javaMLS external commit can remove an arbitrary group member8.7 High
- legion of the bouncy castle inc. bc-javaOpenPGP certification accepted from a subkey without certification authority8.2 High
- formbricksFormbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head...5.1 Medium
- langchain-ai langgraphLangGraph SDK custom auth silently ignores actions= on resource decorators7.6 High
- google chromeIncorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97...9.6 Critical
- yeswikiYesWiki before 4.6.7 Scope Bypass via Triples Delete API7.2 High
- tryghost ghostGhost: Editors Could Promote Staff Users to Their Own Role4.3 Medium
- tryghost ghostGhost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment5.3 Medium
- calcom cal.diycalcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization5.3 Medium
- discord libdaveImproper MLS Welcome roster validation in Discord libdave allows unauthorized group membership9.4 Critical
- rt-labs ab c-openRT-Labs AB C-Open CANopen SDO Server Write Protection Bypass7.1 High
- obot-platform obotObot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route8.6 High
- tryghost ghostGhost 5.125.1 before 6.57.1 Information Disclosure via Feedback5.3 Medium
- tryghost ghostGhost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token5.3 Medium
- tryghost ghostGhost 4.0.0 before 6.63.0 Restricted Content Bypass8.7 High
- tryghost ghostGhost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification7.1 High
- Show moreLoading…