CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- devolutions server, mariadb +1 moreMariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges8.8 High
- mailuMailu: Domain managers can allow themselves to spoof on other hosted domains they should not control8.2 High
- devolutions serverIncorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows...6.5 Medium
- devolutions serverImproper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier...4.3 Medium
- nord security nordvpnMissing Authorization in NordVPN for Windows6.8 Medium
- mattermost, mattermost server +1 morePrivate team metadata disclosure via the team search API4.3 Medium
- mattermost, mattermost server +1 moreMattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access5.0 Medium
- mattermost, mattermost server +1 moreMattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token4.4 Medium
- mattermost, mattermost server +1 moreMattermost guest account privilege escalation via member roles API6.5 Medium
- bilalnaseer wsp mcp – free mcp plugin for wordpress: connect claude, chatgpt & ai agentsWSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool6.5 Medium
- unknown smushSmush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite2.7 Low
- wheelsWheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote...8.6 High
- No product listedZ.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers...7.8 High
- classroomioClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes7.1 High
- naichen thinkcmfThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API8.7 High
- atalayalabs oxicloudOxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie6.3 Medium
- palo alto networks idira secrets manager (self-hosted)Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API8.6 High
- openstack horizon, the opennms group meridian +1 moreOpenNMS REST authorization bypass via non-canonical HTTP method9.1 Critical
- discourse discourse-activity-pubDiscourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening8.6 High
- opnsense coreOPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection7.1 High
- eclipse foundation connected services platformIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver...7.5 High
- No product listedAn unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an u…9.3 Critical
- apostrophecmsApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as...5.3 Medium
- heymrun heymHeym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field7.1 High
- renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 moreRenovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset9.0 Critical
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters7.2 High
- n8n-io n8nn8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows7.2 High
- sonicwall network security manager (nsm)An improper access control vulnerability has been identified in the SonicWall Network Security...8.8 High
- bbpressbbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream6.3 Medium
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...8.6 High
- discourseDiscourse: Media uploads remain publicly accessible after category permissions are restricted7.5 High
- progress moveit transferMOVEit Transfer Authorization Flaw in Certificate Management7.5 High
- giteaGitea private attachment disclosure through repository mismatch5.9 Medium
- giteaGitea API token scope escalation through HTTP signatures8.1 High
- giteaGitea private workflow badge token scope bypass4.3 Medium
- giteaGitea fork workflow approval bypass through review events8.8 High
- giteaGitea private comparison disclosure with public-only tokens6.5 Medium
- giteaGitea private migration creation with public-only tokens5.4 Medium
- giteaGitea organization repository creation token scope bypass5.4 Medium
- giteaGitea restricted-user organization metadata disclosure4.3 Medium
- giteaGitea organization team policy bypass through repository API6.5 Medium
- krayin laravel-crmVentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment7.0 High
- google cloud application integrationImproper Authorization in Google Cloud Application Integration Leads to Privilege Escalation7.3 High
- unknown yith woocommerce popupYITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion4.9 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update5.3 Medium
- nixos nixNix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by...4.3 Medium
- nixos nixNix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an...4.3 Medium
- inductive automation ignitionInductive Automation Ignition Software Incorrect Authorization8.7 High
- google chromeIncorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local...9.6 Critical
- google chromeIncorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a...8.6 High
- Show moreLoading…