CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeMemory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeMemory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeUse after free in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47...8.8 High
- google chromeMemory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...6.5 Medium
- google chromeOut of bounds read in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeUse after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- amazon kiro crewMissing authorization in the WhatsApp channel in Kiro Crew9.0 Critical
- @clerk express, @modelcontextprotocol sdk, server +2 more +4 moreModel Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service6.8 Medium
- xerj console apiAuthentication Bypass via Bearer Tokens to Unauthorized Credential Minting9.1 Critical
- apostrophecms apostropheApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)6.9 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted broken authorization schema8.8 High
- @apostrophecms mport-export, apostrophecms apostrophe +1 moreApostropheCMS: Archive duplicate continuation lets contributors overwrite published content6.5 Medium
- froxlorFroxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API5.3 Medium
- outlineOutline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions6.9 Medium
- jleyva moodle-block configurablereportsConfigurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data7.1 High
- tester-army @e2e-dev/github@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker5.1 Medium
- finsys dockhandDockhand before 1.0.46 Arbitrary File Read via /api/system/files/content7.1 High
- grafana enterpriseCross-organization user modification and deletion via the SCIM API in Grafana Enterprise6.7 Medium
- zyxel ex3501-t0 firmwareAn incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0...6.5 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved network restrictions. This issue is fixed in...7.5 High
- craftcms cmsCraft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations9.3 Critical
- parse-community parse-serverParse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass2.3 Low
- parse-community parse-serverParse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update6.9 Medium
github.com/envoyproxy/ai-gatewayGoagent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable6.8 Medium- fossbillingFOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions2.3 Low
- camunda 7Camunda Broken Access Control via Cockpit6.0 Medium
- sgl-project sglang-routersglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes5.3 Medium
- apache software foundation answerApache Answer: Email Code Purpose Confusion May Allow Account Takeover5.4 Medium
- apache software foundation answerApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions7.5 High
- google samInsecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)9.3 Critical
- giteaGitea label deletion across repository and organization IDs3.1 Low
- oneuptimeOneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions5.3 Medium
- projectsendProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities8.6 High
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor5.5 Medium
- david-crty databasementDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization5.1 Medium
- coderCoder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC6.0 Medium
- coderCoder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy5.3 Medium
- thorsten phpmyfaqphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php5.3 Medium
- thorsten phpmyfaqphpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API5.1 Medium
- lizardbyte sunshineDisabled Sunshine clients can bypass revocation with a derived client certificate7.6 High
- getarcaneapp arcaneArcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`4.3 Medium
- tandoorrecipes recipesTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content8.1 High
- exrick xbootExrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter5.3 Medium
- steedos steedos-platformSteedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API5.3 Medium
- hestiacpHestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation8.6 High
- freertos freertos-kernelIncorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel9.3 Critical
- Show moreLoading…