CWE-285: Improper Authorization, page 2
Filter
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
What the weakness is: CWE-285 at MITRE
Ask an AI about CWE-285
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-285: Improper Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/285.html and https://cve.bz/cve/cwe/285?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.5CVE-2026-109605EPSS 0.4%
A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type le…
- 5.3CVE-2026-109962EPSS 0.3%
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlSe…
- 5.5CVE-2026-109116EPSS 0.3%
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument…
- 7.1CVE-2026-17475EPSS 0.2%
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.
- 5.3CVE-2023-54410EPSS 0.2%
Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they l…
- 8.7CVE-2026-84314EPSS 0.4%
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though t…
- 5.3CVE-2026-108924EPSS 0.3%
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to …
- 5.5CVE-2026-108899EPSS 0.5%
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes impr…
- 2.1CVE-2026-108890EPSS 0.4%
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Termin…
- 5.5CVE-2026-108812EPSS 0.3%
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be perf…
- 5.3CVE-2026-108797EPSS 0.3%
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. T…
- 5.3CVE-2026-108796EPSS 0.2%
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to author…
- 2.1CVE-2026-108575EPSS 0.2%
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authori…
- 2.1CVE-2026-108574EPSS 0.2%
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_management_endpoints.py of the component Spend Tracking. Executing a ma…
- 7.5CVE-2026-11930EPSS 0.2%
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers.
- 7.4CVE-2026-16181EPSS 0.3%
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
- 4.3CVE-2026-76275EPSS 0.3%
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identi…
- 8.8CVE-2026-104632EPSS 0.4%
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the p…
- 2.0CVE-2026-105703EPSS 0.2%
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. …
- 2.1CVE-2026-105621EPSS 0.2%
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Up…
- 2.0CVE-2026-105611EPSS 0.2%
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail…
- 2.0CVE-2026-105610EPSS 0.2%
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Para…
- 2.1CVE-2026-105572EPSS 0.2%
A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypas…
- 5.5CVE-2026-105571EPSS 0.3%
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper a…
- 5.5CVE-2026-105382EPSS 0.3%
A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This mani…
- 5.4CVE-2026-104955EPSS 0.2%
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ to…
- 9.3CVE-2026-105284EPSS 0.8%
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorizatio…
- 2.1CVE-2026-105171EPSS 0.2%
A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file …
- 2.1CVE-2026-105097EPSS 0.3%
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization byp…
- 2.1CVE-2026-105096EPSS 0.3%
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypas…
- 6.9CVE-2026-105121EPSS 0.3%
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-…
- 7.6CVE-2026-105119EPSS 0.2%
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carr…
- 8.2CVE-2026-71886EPSS 0.2%
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted…
- 5.3CVE-2026-104910EPSS 0.3%
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without…
- 7.1CVE-2026-104908EPSS 0.3%
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclusively to the importing user's organisation, with the defau…
- 9.1CVE-2026-51876EPSS 0.3%
DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing…
- 5.3CVE-2026-103858EPSS 0.2%
MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a sin…
- 7.1CVE-2026-103659EPSS 0.2%
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level …
- 6.9CVE-2026-103532EPSS 0.4%
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password…
- 2.1CVE-2026-103233EPSS 0.2%
A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation o…
- 5.3CVE-2026-93547EPSS 0.4%
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are…
- 5.4CVE-2026-13720EPSS 0.2%
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authori…
- 2.0CVE-2026-102846EPSS 0.2%
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Config…
- 2.0CVE-2026-102844EPSS 0.3%
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Exec…
- 6.0CVE-2026-86105EPSS 0.3%
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted req…
- 7.2CVE-2026-86101EPSS 0.2%
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially cra…
- 4.3CVE-2026-81569EPSS 0.2%
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub…
- 5.5CVE-2026-102293EPSS 0.3%
A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to …
- 2.1CVE-2026-102261EPSS 0.3%
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avata…
- 2.1CVE-2026-101006EPSS 0.2%
A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulat…