cve.bz

CWE-863: Incorrect Authorization, page 24

Filter

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

Ask an AI about CWE-863

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-863: Incorrect Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/863.html and https://cve.bz/cve/cwe/863?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2026-73049EPSS 0.3%

    SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can …

  2. 8.3CVE-2026-72859EPSS 0.2%

    Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route w…

  3. 8.7CVE-2026-72831EPSS 0.9%

    The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply th…

  4. 8.8CVE-2026-73841EPSS 0.8%

    OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view…

  5. 8.8CVE-2026-73305EPSS 0.5%

    Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValida…

  6. 5.4CVE-2026-72673EPSS 0.3%

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics private locations can be shared with more than…

  7. 7.7CVE-2026-72672EPSS 0.4%

    The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user…

  8. 7.1CVE-2026-72643EPSS 0.4%

    Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearc…

  9. 7.1CVE-2026-72630EPSS 0.3%

    Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration po…

  10. 7.1CVE-2026-73652EPSS 0.4%

    vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm …

  11. 4.3CVE-2026-58444EPSS 0.4%

    Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

  12. 9.1CVE-2026-58443EPSS 0.6%

    Public-only repository tokens can update private PR head branches

  13. 4.3CVE-2026-58431EPSS 0.3%

    Public-only API token restriction is not enforced on team API routes

  14. 7.5CVE-2026-58427EPSS 0.5%

    Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

  15. 4.3CVE-2026-58425EPSS 0.3%

    OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

  16. 7.1CVE-2026-58416EPSS 0.3%

    Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

  17. 6.5CVE-2026-57897EPSS 0.4%

    Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

  18. 9.6CVE-2026-56443EPSS 0.5%

    Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  19. 8.1CVE-2026-55987EPSS 0.4%

    OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

  20. 8.1CVE-2026-24791EPSS 0.4%

    Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

  21. 4.3CVE-2026-73571EPSS 0.3%

    An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests…

  22. 8.6CVE-2026-70463EPSS 0.4%

    rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name whe…

  23. 9.1CVE-2026-70452EPSS 0.5%

    rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for…

  24. 6.9CVE-2026-53786EPSS 0.4%

    rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge fil…

  25. 4.3CVE-2026-19182EPSS 0.3%

    An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also as…

  26. 8.8CVE-2026-49473EPSS 0.5%

    @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing…

  27. 9.6CVE-2026-71193EPSS 0.5%

    In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a diffe…

  28. 7.1CVE-2026-73499EPSS 0.7%

    etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive…

  29. 6.9CVE-2026-72792EPSS 0.3%

    SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag v…

  30. 6.9CVE-2026-72788EPSS 0.4%

    SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrat…

  31. 9.9CVE-2026-63297EPSS 0.3%

    An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a targe…

  32. 9.9CVE-2026-63296EPSS 0.4%

    An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without vali…

  33. 4.3CVE-2026-63295EPSS 0.3%

    An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.co…

  34. 9.9CVE-2026-62420EPSS 0.5%

    An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via …

  35. 4.3CVE-2026-18433EPSS 0.4%

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace …

  36. 4.3CVE-2026-8667EPSS 0.4%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify…

  37. 8.5CVE-2026-15423EPSS 0.4%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permission…

  38. 5.3CVE-2026-73290EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and r…

  39. 8.1CVE-2026-73289EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNot…

  40. 8.1CVE-2026-73286EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versioni…

  41. 7.5CVE-2026-73285EPSS 0.5%

    RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_ta…

  42. 6.5CVE-2026-73265EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals with…

  43. 4.3CVE-2026-68755EPSS 0.3%

    A bundle writer may create misleading release promotion information under specific conditions.

  44. 5.7CVE-2026-18171EPSS 0.1%

    Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory s…

  45. 8.1CVE-2026-47231EPSS 0.4%

    Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` han…

  46. 6.5CVE-2026-47230EPSS 0.3%

    Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): th…

  47. 6.5CVE-2026-47227EPSS 0.3%

    Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) corresponds to a module the actor administers. The follow-up "is this specific category …

  48. 6.5CVE-2026-64952EPSS 0.3%

    The hunt_delete() VQL function allows deleting hunts.  Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assig…

  49. 4.3CVE-2026-18046EPSS 0.3%

    The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-…

  50. 4.3CVE-2026-15388EPSS 0.3%

    The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticate…