CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- sandboxie-plus sandboxieSandboxie-Plus: Sandbox containment bypass6.9 Medium
- yealink ax83h、ax86r, cp925, cp935w +10 more +12 moreCertain Yealink terminal devices before 2026-04-21 contain an improper access control...4.3 Medium
- ayecode ltd payment forms, buy now buttons, and invoicing system | getpaidGetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API7.1 High
- apache software foundation zookeeperApache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID8.6 High
- carazo import and export users and customersImport and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save8.8 High
- sensiolabs symfonySymfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control6.3 Medium
- quest foglight for databasesQuest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability8.8 High
- tanium enforceTanium addressed an improper access controls vulnerability in Enforce.6.5 Medium
- tanium discoverTanium addressed an improper access controls vulnerability in Discover.4.2 Medium
- tanium discoverTanium addressed an improper access controls vulnerability in Discover.3.1 Low
- docker buildxBake filesystem path entitlements approval can be skipped in some multi-target builds5.6 Medium
- google chromeIncorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote...5.4 Medium
- google chromeIncorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote...8.8 High
- google chromeIncorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker...5.1 Medium
- google chromeIncorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...4.3 Medium
- google chromeIncorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...8.8 High
- google chromeIncorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote...4.3 Medium
- google chromeIncorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote...4.3 Medium
- google chromeIncorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote...5.4 Medium
- google chromeIncorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...4.3 Medium
- google chromeIncorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...8.8 High
- google chromeIncorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local...9.8 Critical
- google chromeIncorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote...8.8 High
- google chromeIncorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a...4.3 Medium
- google chromeIncorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote...8.1 High
- google chromeIncorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote...5.3 Medium
- google chromeIncorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38...6.5 Medium
- google chromeIncorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a...6.5 Medium
- google chromeIncorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...8.8 High
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...8.8 High
- google chromeIncorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...8.1 High
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...9.6 Critical
- google chromeIncorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote...8.3 High
- google chromeIncorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...8.1 High
- google chromeIncorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent...5.3 Medium
- google chromeIncorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...6.5 Medium
- google chromeIncorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeIncorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote...8.1 High
- google chromeIncorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...7.4 High
- google chromeIncorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote...9.6 Critical
- google chromeIncorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote...9.6 Critical
- google chromeIncorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote...9.6 Critical
- google chromeIncorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a...8.8 High
- perforce puppet enterpriseCertificate Name Authorization Bypass9.0 Critical
- Show moreLoading…