CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation traffic serverApache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials7.0 High
- sourcecodester food order management systemSourceCodester Food Order Management System Admin Endpoint authorization6.9 Medium
- apache software foundation pulsarApache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation7.7 High
- apache software foundation pulsarApache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all2.3 Low
- drupal rabbit holeRabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-2526.5 Medium
- drupal ai file to textAI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-2514.3 Medium
- apache software foundation pulsarApache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download6.0 Medium
- drupal fullcalendar viewFullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-2445.4 Medium
- apache software foundation pulsarApache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission2.3 Low
- drupal media bulk uploadMedia Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-2435.4 Medium
- drupal frontend editingFrontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-2415.4 Medium
- drupal simple user managementSimple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-2396.3 Medium
- drupal domainDomain - Moderately critical - Access bypass - SA-CONTRIB-2026-2386.3 Medium
- @clerk nuxtNuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive6.3 Medium
- drupal view unpublishedView Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-2355.3 Medium
- @clerk nuxtNuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes6.5 Medium
- drupal dopupDopup - Critical - Information disclosure - SA-CONTRIB-2026-2275.3 Medium
- progressive robot ltd hmailserverIncorrect Authorization in hMailServer7.8 High
- progressive robot ltd hmailserverIncorrect Authorization in hMailServer7.5 High
- progressive robot ltd hmailserverIncorrect Authorization in hMailServer5.0 Medium
- nous research hermes agentCVE-2026-1144637.5 High
- easysoft zentaopmsZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods7.1 High
- acronis cyber infrastructureSensitive information disclosure and manipulation due to improper authorization checks. The...3.3 Low
- acronis cyber infrastructureSensitive information disclosure and manipulation due to improper authorization checks. The...9.1 Critical
- oneplus oxygenosOnePlus OxygenOS exposed dangerous method vulnerability8.4 High
- unknown sumit payment gateway for woocommerceSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback5.3 Medium
- uncanny owl toolkit for learndash, unknown uncanny toolkit for learndash +1 moreUncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization5.0 Medium
- unknown synchrony financingSynchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route6.5 Medium
- openstack manilaIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify...9.9 Critical
- triggerdotdev trigger.devTrigger.dev before 4.5.12 Authorization Bypass via Alert Channels API5.3 Medium
- triggerdotdev trigger.devTrigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route7.1 High
- arcadedata arcadedbArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization7.7 High
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...6.5 Medium
- oracle corporation java seVulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are...4.7 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...4.9 Medium
- oracle soa suiteVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric...7.1 High
- oracle soa suiteVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric...9.6 Critical
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...4.4 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...4.5 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...5.3 Medium
- oracle purchasingVulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: PO View...6.5 Medium
- oracle payrollVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Element Types,...6.5 Medium
- oracle payrollVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal...6.5 Medium
- oracle order managementVulnerability in the Oracle Order Management product of Oracle E-Business Suite (component:...6.5 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...5.0 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...4.3 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...5.4 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...5.4 Medium
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...3.6 Low
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...5.5 Medium
- Show moreLoading…