CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- node-opcuanode-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions9.1 Critical
- hewlett packard enterprise (hpe) fabric composerAuthenticated Authorization Bypass in the API of HPE Networking Fabric Composer6.5 Medium
- traptitech traqtraQ: Privilege escalation by OAuth prompt=none request7.3 High
- netbox-community netboxNetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView5.3 Medium
- elastic elasticsearchIncorrect Authorization in Elasticsearch Leading to Information Disclosure4.3 Medium
- nvidia slurmNVIDIA Slurm contains some inconsistent authorization checks against the Operator permission...5.7 Medium
- ctfdCTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint6.9 Medium
- a466350665 smart-ssosmart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation8.7 High
- surrealdbSurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner5.3 Medium
- parse-community parse-serverParse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession2.3 Low
- axxonsoft axxonnetRead-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet5.3 Medium
- unknown wemailweMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()3.8 Low
- temporal technologies, inc. serverTemporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host8.7 High
- outlineOutline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft5.3 Medium
- laradashboardLaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades8.6 High
- laradashboardLaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool5.3 Medium
- madong-code madong-admin-saasmadong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware8.7 High
- giteaGitea user and organization feed token scope bypass4.3 Medium
- giteaGitea public-only token bypass on bulk organization repository deletion7.5 High
- giteaGitea OAuth2 userinfo private group disclosure to public-only tokens4.3 Medium
- giteaGitea public-only package token access to private OCI blobs9.1 Critical
- giteaGitea public-only token bypass through Actions runner registration9.1 Critical
- giteaGitea Actions fork workflow trust through pull request review commit6.5 Medium
- google androidIn multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic...5.5 Medium
- google androidIn multiple locations, there is a possible permission bypass due to a logic error in the code....5.5 Medium
- google androidIn multiple locations, there is a possible way to dump secure cache lines into non-secure memory...2.3 Low
- google androidIn cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a...6.7 Medium
- gnome epiphanyepiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access6.5 Medium
- drupal file force downloadFile Force Download for Drupal 7 Access Bypass via Unconditional Download Headers8.7 High
- inex ixp-managerIXP Manager has Broken Object-Level Authorization8.3 High
- tryghost activitypubActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts5.3 Medium
- filecoin-project filecoin-pinFilecoin Pin: Fork bypass in the privileged GitHub Actions workflow8.2 High
- basekick-labs arcArc: DuckDB I/O aliases bypass database RBAC after CVE-2026-477356.5 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks9.2 Critical
- delinea secret server (on-prem)Secret Server JWT issuance error8.7 High
- kohler hotcrpHotCRP: comment-author search exposes anonymous commenter identities6.5 Medium
- apache software foundation pinotApache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()6.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability4.4 Medium
- freedom of the press securedropSecureDrop: API session token reuse against the Journalist Interface web UI5.0 Medium
- openstack keystonemiddlewareIn OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a...8.3 High
- bytebase dbhubDBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation6.1 Medium
- collaboraonline onlineCollabora Online: Read-only session authorization bypass permits live document edits4.3 Medium
github.com/charmbracelet/soft-serveGocharmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories5.3 Medium- orchardcms orchardOrchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check7.1 High
- traefikTraefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret2.1 Low
- arketeam bdf, protectelmaj +1 moreIncorrect authorization in Protectel5.1 Medium
- bitwarden serverBitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create5.3 Medium
- sqliteSQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING2.0 Low
- proftpdProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass5.3 Medium
- red hat streams for apache kafka 2, streams for apache kafka 3 +1 moreKroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules6.5 Medium
- Show moreLoading…