CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeOut of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote...4.3 Medium
- google chromeUse after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to...8.8 High
- google chromeUse after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker...8.8 High
- google chromeUse after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to...8.8 High
- google chromeUse after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to...8.8 High
- @clerk nuxt, @nuxt nitro-server +1 moreNuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes6.5 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad vulnerable to cross-namespace information disclosure in multiple endpoints4.3 Medium
- shopify appShopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps7.6 High
- aws aws-privateca-issuerIncorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes8.4 High
- centreonBroken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users5.4 Medium
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge for Android Security Feature Bypass Vulnerability4.3 Medium
- elastic cloud enterpriseIncorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings4.3 Medium
- No product listedAn issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's...7.5 High
- oauthlibOAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client8.4 High
- langchain-ai langgraph-apiLangGraph JavaScript custom authentication may permit cross-user Store access8.6 High
- labstack echoEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path7.5 High
- tooljetToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard6.9 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass5.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow5.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows5.1 Medium
- n8n-io n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass5.3 Medium
- drupal field permissionsField Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-2895.3 Medium
- drupal field permissionsField Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-2885.3 Medium
- drupal bulk update user rolesBulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-2804.7 Medium
- drupal fasttoggleFasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-2825.4 Medium
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-2683.7 Low
- drupal commerce shippingCommerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-2622.7 Low
- drupal commerce shippingCommerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-2616.5 Medium
- drupal commerce licenseCommerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-2606.3 Medium
- drupal commerce coreCommerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-2572.7 Low
- drupal commerce coreCommerce Core - Less critical - Access bypass - SA-CONTRIB-2026-2564.3 Medium
- drupal commerce coreCommerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-2555.3 Medium
- grafana enterprise, oss +1 moreAlerting contact point authorization bypass via schema downgrade7.7 High
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability4.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax3.8 Low
- google chromeMemory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...8.8 High
- asterisk, asterisk certified-asterisk +1 moreAsterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE7.5 High
- modelcontextprotocol python-sdkModel Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server6.8 Medium
- tanium complyTanium addressed an improper access controls vulnerability in Comply.4.3 Medium
- m1k1o nekoNeko: Authorization bypass in legacy WebRTC input handling5.4 Medium
- adobe campaign classicAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)9.9 Critical
- veeam backup for microsoft 365A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to...8.3 High
- maz1987in 3dviewer-nextcloud3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share7.5 High
- esaqa gmbh psonoURL prefix handling permits API key read-scope bypass in Psono Server4.3 Medium
- code-projects simple content management systemcode-projects Simple Content Management System Admin welcome.php authorization6.9 Medium
- apple ipados, macos, visionos +2 more +4 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...3.3 Low
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...5.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...3.3 Low
- Show moreLoading…