CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- argoproj argo-cdArgo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks9.9 Critical
- esri portal for arcgisPortal for ArcGIS has a security vulnerability6.5 Medium
- jupyter notebook, jupyterlab, jupyterlab jupyterlite-core +2 moreJupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked4.2 Medium
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization6.9 Medium
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization6.9 Medium
- drakkan sftpgoSFTPGo source-side file-pattern filter bypass during copy operations4.3 Medium
- the-40-thieves obsidian-tcobsidian-tc symlink path mismatch bypasses read ACL restrictions4.7 Medium
- the-40-thieves obsidian-tcobsidian-tc bridge tools expose data outside the read ACL4.3 Medium
- wazuh wazuh-agentWazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies8.6 High
- wazuh wazuh-managerWazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user8.6 High
- wazuh wazuh-managerWazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions5.3 Medium
- gitlabIncorrect Authorization in GitLab4.2 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab2.7 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabIncorrect Authorization in GitLab8.5 High
- gitlabIncorrect Authorization in GitLab4.2 Medium
- gitlabIncorrect Authorization in GitLab7.7 High
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabIncorrect Authorization in GitLab4.2 Medium
- gitlabIncorrect Authorization in GitLab2.7 Low
- sap se hana (display product catalog based on customs declaration)Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)4.3 Medium
- aaif-goose goosegoose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations2.3 Low
- continuedev continueContinue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining7.7 High
- tianma-if edgeeverEdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate8.4 High
- frappe erpnextERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html5.3 Medium
- temporal technologies, inc. serverTemporal Server applies inbound namespace replication from a connected peer cluster to local namespaces7.0 High
- the-40-thieves obsidian-tcobsidian-tc tokens can access arbitrary configured vaults9.9 Critical
- zitadelZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation5.1 Medium
- surrealdbSurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after5.3 Medium
- parse-community parse-serverParse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries6.3 Medium
- open-webuiOpen WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID5.3 Medium
- open-webuiOpen WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata2.3 Low
- open-webuiOpen WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange5.3 Medium
- neo4j @neo4j/graphql@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier8.6 High
- jishenghua jsherpjshERP through 3.6 Incorrect Authorization via /supplier/exportExcel5.3 Medium
- jishenghua jsherpjshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list5.3 Medium
- moxi624 mogublogMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig7.1 High
- lavalite cmsLavaLite CMS through 10.1.2 Authorization Bypass via User Update API7.1 High
- apache software foundation skywalking banyandbApache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy9.1 Critical
- mikrotik routerosMikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation8.7 High
- red hat satellite 6Foreman: domain and subnet interface api skips host search filters5.4 Medium
- vearchVearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources8.7 High
- cortezaproject cortezaCorteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints8.2 High
- plastic labs honchoPlastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces5.3 Medium
- unknown fundiin cho woocommerceFundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure9.1 Critical
- unknown squadenoSquadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit2.7 Low
- Show moreLoading…