cve.bz

CWE-285: Improper Authorization, page 8

Filter

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-285 at MITRE

Ask an AI about CWE-285

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-285: Improper Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/285.html and https://cve.bz/cve/cwe/285?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-15909EPSS 0.4%

    A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kd_cs leads to authorization bypass. Th…

  2. 7.1CVE-2026-53515EPSS 0.4%

    Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization beca…

  3. 7.6CVE-2026-45337EPSS 0.2%

    Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim …

  4. 5.4CVE-2026-49997EPSS 0.3%

    SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled…

  5. 7.8CVE-2026-58540EPSS 0.3%

    Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

  6. 8.8CVE-2026-58277EPSS 0.9%

    Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  7. 8.8CVE-2026-54121EPSS 0.8%

    Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

  8. 7.8CVE-2026-50346EPSS 0.3%

    Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-50344EPSS 0.3%

    Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-58631EPSS 0.3%

    Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.

  11. 7.8CVE-2026-49170EPSS 0.3%

    Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

  12. 5.5CVE-2026-15622EPSS 0.6%

    A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can l…

  13. 2.9CVE-2026-15594EPSS 0.5%

    A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in imp…

  14. 2.9CVE-2026-15516EPSS 0.4%

    A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. Th…

  15. 2.1CVE-2026-15510EPSS 0.3%

    A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made p…

  16. 2.1CVE-2026-15509EPSS 0.3%

    A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carr…

  17. 7.2CVE-2026-56313EPSS 0.5%

    Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delete password identities of users in foreign organizations. Attackers with org.upda…

  18. 7.2CVE-2026-56241EPSS 0.3%

    Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being clear…

  19. 2.1CVE-2026-15499EPSS 0.3%

    A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a manipulation of the ar…

  20. 2.1CVE-2026-15474EPSS 0.3%

    A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in imprope…

  21. 2.1CVE-2026-15473EPSS 0.3%

    A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authoriza…

  22. 2.1CVE-2026-15472EPSS 0.3%

    A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a manipulation can lead to improper authorization. The attack can be exec…

  23. 2.1CVE-2026-15471EPSS 0.3%

    A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is poss…

  24. 2.1CVE-2026-15470EPSS 0.3%

    A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Such manipulation leads to improper authorization. The attack may be launched remo…

  25. 5.3CVE-2026-56240EPSS 0.2%

    Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergenc…

  26. 4.3CVE-2026-55664EPSS 0.3%

    Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actua…

  27. 2.1CVE-2026-15377EPSS 0.3%

    A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiat…

  28. 2.1CVE-2026-15376EPSS 0.3%

    A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulation results in improper authorization. The attack can be launched remotely. The …

  29. 2.1CVE-2026-15375EPSS 0.3%

    A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack…

  30. 2.1CVE-2026-15374EPSS 0.3%

    A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is poss…

  31. 2.1CVE-2026-15373EPSS 0.3%

    A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It i…

  32. 2.1CVE-2026-15318EPSS 0.4%

    A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id ca…

  33. 7.1CVE-2026-55212EPSS 0.4%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the…

  34. 4.3CVE-2026-59226EPSS 0.5%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automation…

  35. 2.1CVE-2026-15191EPSS 0.4%

    A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a m…

  36. 6.5CVE-2026-58252EPSS 0.5%

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped…

  37. 6.5CVE-2026-58251EPSS 0.5%

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by usin…

  38. 2.1CVE-2026-15036EPSS 0.4%

    A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/list_all.go of the component gitspaces Endpoint. Executing a manipulation can lead …

  39. 5.3CVE-2026-56293EPSS 0.2%

    Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to…

  40. 7.2CVE-2026-56246EPSS 0.4%

    Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a…

  41. 8.2CVE-2026-55428EPSS 0.4%

    Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID b…

  42. 7.2CVE-2026-55077EPSS 0.6%

    Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did no…

  43. 4.3CVE-2026-46700EPSS 0.3%

    Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /s…

  44. 9.9CVE-2026-34048EPSS 0.8%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing …

  45. 5.5CVE-2026-44362EPSS 0.2%

    OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20.0 and prior to version 4.11.0, a vulnerability in OP…

  46. 5.3CVE-2026-14794EPSS 0.4%

    A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument us…

  47. 5.3CVE-2026-14793EPSS 0.4%

    A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass…

  48. 5.5CVE-2026-14778EPSS 0.5%

    A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argu…

  49. 5.5CVE-2026-14753EPSS 0.5%

    A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation…

  50. 2.1CVE-2026-14716EPSS 0.4%

    A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads …