CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- multivendorxMultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint7.1 High
- tabularisdb tabularisTabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification5.8 Medium
- pulseaiclub phiPhi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir6.0 Medium
- 1mcp-app @1mcp/agent1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter5.3 Medium
- iflytek skillhubSkillHub before 0.2.22 Account Takeover via Account Merge Flow8.7 High
- strapiStrapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions5.3 Medium
- awordpresslife portfolio filter galleryPortfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions4.7 Medium
- croixhaug simply schedule appointmentsAppointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token5.3 Medium
- go-vikunja vikunjaVikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion5.3 Medium
- go-vikunja vikunjaVikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks7.1 High
- go-vikunja vikunjaVikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation5.3 Medium
- iflytek astron-agentAstron Agent: Unsandboxed code-node leads to cross-tenant RCE9.9 Critical
- contaoContao: Improper access control in the table access voter4.3 Medium
- john-broadway paciolipacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents5.7 Medium
- devolutions server, mariadb +1 moreMariaDB: database privilege escalation via user / role name collision in the acl cache6.4 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...6.5 Medium
- ash-project ashAsh.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts6.0 Medium
- strawberry-graphql strawberryStrawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy7.5 High
- winsiderss system informerSystem Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port8.5 High
- dolibarrDolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php5.3 Medium
- openstack mistralIn OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object...7.2 High
- openstack mistralIn OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted...6.0 Medium
- cisa malcolmIncorrect Authorization in Malcolm5.4 Medium
- cisa malcolmIncorrect Authorization in Malcolm8.1 High
- cisa malcolmAuthentication Bypass by Spoofing in Malcolm6.5 Medium
- zimbra collaboration suiteZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion6.5 Medium
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Incorrect Authorization6.5 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information6.5 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords7.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint8.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint8.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）6.5 Medium
- stumpapp stumpIn Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates...5.4 Medium
- octopus deploy serverIn affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments...8.7 High
- asynchttpclient async-http-clientAsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities7.6 High
- asynchttpclient async-http-clientAsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins7.4 High
- splunk, splunk enterprise +1 moreImproper Authorization through the REST API in Splunk Enterprise4.3 Medium
- drupal restrict route by ipRestrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-2167.3 High
- drupal smartlinker aiSmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-2104.3 Medium
- drupal gutenbergGutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-2025.4 Medium
- drupal inline entity form dialogInline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-1995.4 Medium
- drupal actstreamActstream - Critical - Access bypass - SA-CONTRIB-2026-1986.5 Medium
- drupal entity reference manager (merge entities)Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-1946.5 Medium
- imagemagickImageMagick: Policy Bypass when using coder as the domain.6.2 Medium
- @backstage plugin-search-backend, plugin-search-backend-module-elasticsearch, backstage +2 more +4 moreBackstage: Incorrect authorization in search engine permission filtering4.3 Medium
- @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 moreBackstage: Sensitive information disclosure in Kubernetes resource queries5.0 Medium
- wger-project wgerwger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)7.1 High
- obot-platform obotObot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources5.3 Medium
- apache software foundation yunikornApache YuniKorn: Admission control bypass via workload UPDATE operation2.0 Low
- wolfsshwolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check6.3 Medium
- Show moreLoading…