cve.bz

CWE-863: Incorrect Authorization, page 2

Filter

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

Ask an AI about CWE-863

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-863: Incorrect Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/863.html and https://cve.bz/cve/cwe/863?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2026-107263EPSS 0.2%

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

  2. 5.4CVE-2026-107258EPSS 0.2%

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

  3. 6.5CVE-2026-107257EPSS 0.2%

    Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

  4. –CVE-2026-107255EPSS 0.1%

    Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

  5. 6.5CVE-2026-107251EPSS 0.2%

    Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

  6. 6.5CVE-2026-119200EPSS 0.3%

    Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evalua…

  7. 4.3CVE-2026-102260EPSS 0.2%

    HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects …

  8. 8.4CVE-2026-119115EPSS 0.2%

    Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates,…

  9. 7.5CVE-2026-107049EPSS 0.3%

    An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.

  10. 4.3CVE-2026-85330EPSS 0.4%

    Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

  11. 5.4CVE-2025-13050EPSS 0.3%

    Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

  12. 4.3CVE-2026-115712EPSS 0.2%

    Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-on…

  13. 8.4CVE-2026-118669EPSS 0.3%

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential clien…

  14. 8.6CVE-2026-118668EPSS 0.4%

    langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across …

  15. 7.5CVE-2026-118650EPSS 0.4%

    Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static ha…

  16. 6.9CVE-2026-118685EPSS 0.2%

    ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers…

  17. 5.1CVE-2026-118676EPSS 0.2%

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execu…

  18. 5.1CVE-2026-118675EPSS 0.2%

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the E…

  19. 5.1CVE-2026-118642EPSS 0.2%

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing …

  20. 5.3CVE-2026-118640EPSS 0.2%

    n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the global:chatUser role can add and run tools through chat to exe…

  21. 9.1CVE-2026-118264EPSS 0.4%

    Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects…

  22. 7.7CVE-2026-100105EPSS 0.3%

    A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credenti…

  23. 4.3CVE-2026-111960EPSS 0.2%

    The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public ent…

  24. 3.8CVE-2026-111032EPSS 0.2%

    The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any aut…

  25. 7.5CVE-2026-57200EPSS 0.9%

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST In…

  26. 6.8CVE-2026-116684EPSS 0.4%

    The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier acce…

  27. 5.4CVE-2026-116679EPSS 0.3%

    Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input beca…

  28. 4.3CVE-2026-108302EPSS 0.2%

    Tanium addressed an improper access controls vulnerability in Comply.

  29. 8.3CVE-2026-106077EPSS 0.2%

    A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.

  30. 9.9CVE-2026-105780EPSS 0.5%

    Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute ar…

  31. 7.5CVE-2026-104189EPSS 0.4%

    The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who k…

  32. 4.3CVE-2026-117472EPSS 0.3%

    Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was au…

  33. 5.5CVE-2026-116623EPSS 0.4%

    A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in mi…

  34. 6.3CVE-2026-116575EPSS 0.1%

    Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join cal…

  35. 9.9CVE-2026-110720EPSS 0.4%

    Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in …

  36. 9.9CVE-2026-102649EPSS 0.5%

    Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it …

  37. 3.8CVE-2026-93846EPSS 0.2%

    Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission sche…

  38. 3.5CVE-2026-93847EPSS 0.2%

    Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via …

  39. 2.1CVE-2026-116107EPSS 0.2%

    A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation …

  40. 6.0CVE-2026-115635EPSS 0.2%

    Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and th…

  41. 6.0CVE-2026-115627EPSS 0.2%

    Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is…

  42. 6.0CVE-2026-114214EPSS 0.2%

    Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a singl…

  43. 4.8CVE-2026-116140EPSS 0.1%

    ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invo…

  44. 6.0CVE-2026-116136EPSS 0.2%

    ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an interme…

  45. 5.5CVE-2026-111980EPSS 0.2%

    The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including admini…

  46. 6.9CVE-2026-115972EPSS 0.3%

    A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Htt…

  47. 5.3CVE-2026-116020EPSS 0.2%

    BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate seq…

  48. 6.0CVE-2026-115883EPSS 0.3%

    LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, Sq…

  49. 5.3CVE-2026-75525EPSS 0.2%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's ide…

  50. 7.1CVE-2026-112342EPSS 0.3%

    Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only…