cve.bz

CWE-285: Improper Authorization, page 10

Filter

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-285 at MITRE

Ask an AI about CWE-285

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-285: Improper Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/285.html and https://cve.bz/cve/cwe/285?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.0CVE-2026-47298EPSS 0.7%

    Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  2. 6.5CVE-2026-45503EPSS 0.4%

    Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

  3. 7.8CVE-2026-45490EPSS 0.4%

    Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

  4. 7.8CVE-2026-42902EPSS 0.3%

    Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

  5. 2.1CVE-2026-11619EPSS 0.2%

    A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads t…

  6. 8.1CVE-2026-46484EPSS 0.4%

    Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization bypass in the Headscale API client used by node and user rename operations. This i…

  7. 2.1CVE-2026-11533EPSS 0.2%

    A security vulnerability has been detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this vulnerability is an unknown functionality of the file /see.php of the component Student Delet…

  8. 8.8CVE-2026-46656EPSS 0.3%

    Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Sess…

  9. 2.1CVE-2026-11521EPSS 0.3%

    A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controll…

  10. 2.1CVE-2026-11519EPSS 0.3%

    A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The mani…

  11. 1.3CVE-2026-11500EPSS 0.3%

    A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey/client.go of the component Static API Key Handler. The manipulation of the argu…

  12. 2.1CVE-2026-11476EPSS 0.2%

    A security vulnerability has been detected in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this issue is the function edit-admin of the file controllers/AdminController.php of the component…

  13. 5.5CVE-2026-11462EPSS 0.3%

    A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipul…

  14. 2.1CVE-2026-11461EPSS 0.2%

    A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. Such manipulation of the argument Title leads to aut…

  15. 5.3CVE-2026-11441EPSS 0.2%

    A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper a…

  16. 5.3CVE-2026-11440EPSS 0.2%

    A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes im…

  17. 5.3CVE-2026-11439EPSS 0.2%

    A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in i…

  18. 5.3CVE-2026-11438EPSS 0.2%

    A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The a…

  19. 9.8CVE-2026-10580ExploitEPSS 2.9%

    The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::…

  20. 2.1CVE-2026-11336EPSS 0.2%

    A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the com…

  21. 2.1CVE-2026-10876EPSS 0.3%

    A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of t…

  22. 7.5CVE-2026-48579EPSS 1.0%

    Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.

  23. 7.1CVE-2026-41522EPSS 0.2%

    Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authori…

  24. 2.1CVE-2026-10693EPSS 0.2%

    A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper author…

  25. 7.1CVE-2026-33398EPSS 0.2%

    NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/pages/forum/get_quotes.php` only checks whether the caller is logged in, then reads a post by attacker-controlled `post` ID and returns its content. The…

  26. 4.3CVE-2026-41115EPSS 0.3%

    An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented i…

  27. 2.1CVE-2026-10294EPSS 0.2%

    A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The at…

  28. 5.3CVE-2026-10285EPSS 0.2%

    A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The …

  29. 5.3CVE-2026-10284EPSS 0.2%

    A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component L…

  30. 6.5CVE-2026-45275EPSS 0.4%

    Nextcloud is an open source content collaboration platform. Prior to version 2.7.2, a privilege escalation vulnerability exists in the Approval app that allows a user without sharing permissions to force the system to share a file with app…

  31. 5.3CVE-2026-10282EPSS 0.2%

    A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be l…

  32. 10.0CVE-2026-0072EPSS 0.1%

    In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…

  33. 5.5CVE-2026-10272EPSS 0.3%

    A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an unknown function of the file admin/deleteform.php. Such manipulation of the argument sid leads to i…

  34. 5.3CVE-2026-10269EPSS 0.3%

    A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads …

  35. 4.3CVE-2026-46605EPSS 0.3%

    Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from…

  36. 3.1CVE-2026-40963EPSS 0.5%

    The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could …

  37. 5.5CVE-2026-10236EPSS 0.4%

    A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save of the component User Management Endpoint. Such manipulation leads to im…

  38. 2.1CVE-2026-10218EPSS 0.2%

    A vulnerability has been found in nextlevelbuilder GoClaw up to 3.11.3. This affects the function auth of the file internal/http/evolution_handlers.go. Such manipulation leads to improper authorization. The attack can be executed remotely.…

  39. 2.1CVE-2026-10215EPSS 0.3%

    A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation…

  40. 2.1CVE-2026-10212EPSS 0.2%

    A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manipulation of the argument session_id leads to authorization bypass. It is possible…

  41. 2.1CVE-2026-10211EPSS 0.2%

    A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect authorization. It is possible t…

  42. 5.3CVE-2026-10154EPSS 0.2%

    A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can …

  43. 4.3CVE-2026-48810EPSS 0.2%

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reported previously, the same missing mailbox membership check was found in the sibling…

  44. 9.9CVE-2026-47744EPSS 0.3%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any …

  45. 8.1CVE-2026-47740EPSS 0.3%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orde…

  46. 5.1CVE-2026-10070EPSS 0.2%

    A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploi…

  47. 5.3CVE-2026-45620EPSS 0.2%

    WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10. This enables…

  48. 4.3CVE-2026-47713EPSS 0.2%

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, an approved mobile device token created in single-user mode can survive single-user -> multi-user …

  49. 5.3CVE-2026-45297EPSS 0.2%

    OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE e…

  50. 6.5CVE-2026-47673EPSS 0.2%

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regard…