CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +2 more +4 moreCandlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching8.1 High
- giteaGitea profile feed disclosure bypassing user visibility4.3 Medium
- giteaGitea push-to-create bypass of FORCE_PRIVATE policy5.4 Medium
- giteaGitea issue attachment API allows changing comment attachments4.3 Medium
- giteaGitea tag delete route deletes releases without release permission8.1 High
- @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 moreBackstage: Improper URL validation in catalog entity placeholder resolution7.7 High
- @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 moreBackstage: Inconsistent catalog property permission evaluation4.3 Medium
- giteaGitea push mirror API bypass of DISABLE_NEW_PUSH policy4.9 Medium
- @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 moreBackstage: Inconsistent enforcement of allowed location types during catalog processing3.1 Low
- giteaGitea push mirror local path check uses the repository owner7.1 High
- @backstage backend-defaults, backstage, linuxfoundation backstage\/backend-defaults +2 moreBackstage: Improper preservation of access restrictions during service credential delegation7.6 High
- @backstage plugin-catalog-backend-module-gitlab, backstage, linuxfoundation backstage\/plugin-catalog-backend-module-gitlab +2 moreBackstage: Improper authorization in GitLab organizational user ingestion5.4 Medium
- backstage, @backstage plugin-scaffolder-backend, plugin-scaffolder-backend-module-azure +10 more +12 moreBackstage: Scaffolder credential handling may allow unintended GitHub authentication fallback6.4 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Incorrect authorization in scaffolder task listing4.3 Medium
- @backstage plugin-catalog-backend-module-bitbucket-server, backstage, linuxfoundation backstage\/plugin-catalog-backend-module-bitbucket-server +2 moreBackstage: Inconsistent repository filtering in Bitbucket Server catalog event updates6.5 Medium
- @backstage plugin-proxy-backend, backstage, linuxfoundation backstage\/plugin-proxy-backend +2 moreBackstage: Inconsistent credential enforcement for overlapping proxy routes4.8 Medium
- elastic elasticsearchIncorrect Authorization in Elasticsearch Leading to Privilege Escalation7.2 High
- elastic kibanaIncorrect Authorization in Kibana Leading to Sensitive Information Disclosure6.5 Medium
- elastic elasticsearchIncorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification5.4 Medium
- giteaGitea private repository access retained after rejected transfer4.3 Medium
- giteaGitea fork workflow approval bypass through maintainer-triggered events9.8 Critical
- giteaGitea deploy key pushes acting as the repository owner7.1 High
- multiversx labs s.r.l. multisig-improvedCVE-2026-1065119.8 Critical
- google chromeIncorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0...8.8 High
- google chromeIncorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a...9.1 Critical
- google chromeIncorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote...8.8 High
- google chromeIncorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a...5.4 Medium
- google chromeIncorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed...8.8 High
- google chromeIncorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a...5.4 Medium
- google chromeIncorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...4.3 Medium
- google chromeIncorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote...4.3 Medium
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote...4.3 Medium
- google chromeIncorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a...8.2 High
- google chromeIncorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...8.8 High
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local...5.4 Medium
- google chromeIncorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...9.6 Critical
- google chromeIncorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote...8.8 High
- google chromeIncorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a...4.2 Medium
- google chromeIncorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote...4.3 Medium
- google chromeIncorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote...8.8 High
- google chromeIncorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote...8.1 High
- google chromeIncorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed...4.2 Medium
- google chromeIncorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a...5.9 Medium
- google chromeIncorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote...5.4 Medium
- google chromeIncorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a...6.5 Medium
- google chromeIncorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote...5.4 Medium
- google chromeIncorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote...4.8 Medium
- google chromeIncorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote...4.3 Medium
- Show moreLoading…