CWE-863: Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

1. –CVE-2026-119625EPSS 0.3%2026-11-01

   The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user…

2. –CVE-2026-119441EPSS 0.2%2026-11-01

   `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an o…

3. –CVE-2026-118394EPSS 0.2%2026-11-01

   The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that…

4. –CVE-2026-118386EPSS 0.2%2026-11-01

   Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request.…

5. –CVE-2026-117685EPSS 0.2%2026-11-01

   The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `…

6. –CVE-2026-116289EPSS 0.2%2026-11-01

   Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public reposit…

7. 6.5CVE-2026-118598EPSS 0.5%2026-10-31

   A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after…

8. 8.7CVE-2026-110176EPSS 0.2%2026-10-31

   The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself …

9. 7.6CVE-2026-63414EPSS 0.5%2026-10-30

   Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or a…

10. 8.3CVE-2026-63338EPSS 0.3%2026-10-30

    IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in …

11. 5.3CVE-2026-63115EPSS 0.1%2026-10-30

    ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came fr…

12. 8.2CVE-2026-58412EPSS 0.2%2026-10-30

    Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented t…

13. 6.5CVE-2026-55493EPSS 0.3%2026-10-30

    HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can ther…

14. 6.5CVE-2026-55098EPSS 0.3%2026-10-30

    Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In …

15. 9.2CVE-2026-116238EPSS 0.4%2026-10-30

    In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account,…

16. 8.7CVE-2026-115830EPSS 0.3%2026-10-30

    In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

17. –CVE-2026-73322EPSS 0.2%2026-10-30

    Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transfor…

18. 4.4CVE-2026-69446EPSS 0.3%2026-10-30

    Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

19. 6.1CVE-2026-61789EPSS 0.4%2026-10-30

    DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` t…

20. 5.0CVE-2026-50000EPSS 0.4%2026-10-30

    SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API…

21. 8.3CVE-2026-115642EPSS 0.5%2026-10-30

    In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privilege…

22. 4.3CVE-2026-46499EPSS 0.2%2026-10-30

    Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's …

23. 7.1CVE-2026-119649EPSS 0.4%2026-10-30

    Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, cl…

24. 2.1CVE-2026-119573EPSS 0.3%2026-10-30

    Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users w…

25. 5.3CVE-2026-119414EPSS 0.4%2026-10-30

    Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, whe…

26. 2.0CVE-2026-119377EPSS 0.1%2026-10-30

    SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL…

27. 5.3CVE-2026-119147EPSS 0.3%2026-10-30

    ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in …

28. 5.1CVE-2025-68392EPSS 0.2%2026-10-30

    ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.  This issue has been fixed in: PROTECTELMAJ v6.5.19 a…

29. 6.5CVE-2026-118952EPSS 0.2%2026-10-30

    A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this ma…

30. –CVE-2026-118584EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

31. –CVE-2026-118583EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

32. –CVE-2026-118569EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

33. –CVE-2026-118567EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

34. –CVE-2026-118557EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

35. –CVE-2026-118556EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

36. –CVE-2026-118555EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

37. –CVE-2026-118548EPSS 0.2%2026-10-30

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

38. –CVE-2026-118542EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

39. –CVE-2026-118541EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

40. –CVE-2026-118540EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

41. –CVE-2026-114571EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

42. –CVE-2026-114554EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

43. –CVE-2026-114553EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

44. –CVE-2026-114545EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

45. –CVE-2026-114544EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

46. –CVE-2026-114543EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.

47. –CVE-2026-114540EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

48. –CVE-2026-114537EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

49. –CVE-2026-114530EPSS 0.1%2026-10-30

    Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

50. 4.3CVE-2026-107307EPSS 0.2%2026-10-30

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.