CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...3.3 Low
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2...5.5 Medium
- mem0ai mem0Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)6.3 Medium
- hashicorp toolingConsul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules9.9 Critical
- padok-team burritoBurrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset9.9 Critical
- mattermostTeam admin can escalate a team member's permissions via the team member roles endpoint3.8 Low
- mattermost, mattermost server +1 moreImproper post type validation on scheduled post endpoints3.5 Low
- datafeedr product sets pluginDatafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization5.3 Medium
- ash-project ash postgresAshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows6.0 Medium
- ash-project ash postgresAshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set6.0 Medium
- ash-project ashLoading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records6.0 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing4.8 Medium
- projectsendProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking6.0 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant5.5 Medium
- faveosuite faveo helpdeskFaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization6.9 Medium
- bookstackapp bookstackBookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages5.3 Medium
- langchain-ai langgraph, langgraph-checkpoint-postgres, langgraph-checkpoint-sqlite +2 moreLangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores6.0 Medium
livewire/livewirePackagistLivewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order6.5 Medium- labstack echoEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls9.1 Critical
- open-reception appointment-booking-softwareOpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant5.3 Medium
github.com/siyuan-note/siyuan/kernelGoSiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized5.8 Medium- tandoor recipes recipesTandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning7.1 High
- the-40-thieves obsidian-tcobsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes7.1 High
- the-40-thieves obsidian-tcobsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP7.1 High
- baserproject basercmsbaserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure6.5 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action8.1 High
- unknown download monitorDownload Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route4.9 Medium
- siteground speed optimizerSpeed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option5.5 Medium
- unknown essential addons for elementorEssential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action3.8 Low
- authlibAuthlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens4.6 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreIpa: freeipa: freeipa uses subject cn as proof of certificate ownership5.4 Medium
- jitsucom jitsuJitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API2.3 Low
- lxc incusIncus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh5.3 Medium
- openbaoOpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs2.1 Low
- openbaoOpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs2.0 Low
- openbaoOpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal7.5 High
- openbaoOpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial2.1 Low
- smilecdr hapi fhirSmileCDR HAPI FHIR unauthorized read5.3 Medium
- smilecdr hapi fhirSmileCDR HAPI FHIR trusted tenant partition override8.6 High
- phpoffice phpspreadsheetPhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading6.4 Medium
- aws amazon athenaIncorrect authorization checks in Amazon Athena engine version 3 query processing6.3 Medium
- devolutions serverIncorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3...4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment2.7 Low
- unknown mb custom post types & custom taxonomiesMB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export2.7 Low
- wwbn avideoWWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php7.0 High
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration...3.1 Low
- bulwarkmail webmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization...6.8 Medium
- gitlabIncorrect Authorization in GitLab6.8 Medium
- gitlabIncorrect Authorization in GitLab5.9 Medium
- gitlabIncorrect Authorization in GitLab2.7 Low
- Show moreLoading…