cve.bz

CWE-863: Incorrect Authorization, page 25

Filter

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

Ask an AI about CWE-863

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-863: Incorrect Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/863.html and https://cve.bz/cve/cwe/863?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-68432EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->ne…

  2. 7.1CVE-2026-63177EPSS 0.4%

    Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using…

  3. 8.2CVE-2026-19550EPSS 0.5%

    A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged A…

  4. 5.3CVE-2026-73221EPSS 0.4%

    CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints…

  5. 7.2CVE-2026-18712EPSS 0.2%

    An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different colle…

  6. 2.3CVE-2026-18703EPSS 0.1%

    An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restri…

  7. 5.3CVE-2026-18698EPSS 0.2%

    An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of colle…

  8. 7.0CVE-2026-18696EPSS 0.4%

    An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not …

  9. 7.2CVE-2026-18690EPSS 0.4%

    An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical syst…

  10. 5.8CVE-2026-73213EPSS 0.4%

    Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an auth…

  11. 9.3CVE-2026-73090EPSS 0.4%

    PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the hos…

  12. 10.0CVE-2026-71398EPSS 1.2%

    Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. …

  13. 9.1CVE-2026-71362KEVExploitEPSS 90%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does…

  14. 7.7CVE-2026-48447EPSS 0.2%

    Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit dep…

  15. 7.5CVE-2026-48416EPSS 0.8%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitatio…

  16. 8.3CVE-2026-48415EPSS 0.6%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and w…

  17. 7.2CVE-2026-48412EPSS 0.6%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitati…

  18. 4.9CVE-2026-48411EPSS 0.6%

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized wri…

  19. 10.0CVE-2026-27302EPSS 1.2%

    Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. …

  20. 8.8CVE-2026-71387EPSS 0.5%

    ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable com…

  21. 9.6CVE-2026-71384EPSS 0.5%

    is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resu…

  22. 7.3CVE-2026-71383EPSS 0.6%

    is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing …

  23. 7.8CVE-2026-69278EPSS 0.3%

    Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  24. 6.5CVE-2026-63512EPSS 0.7%

    Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

  25. 8.8CVE-2026-62872EPSS 0.8%

    Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

  26. 5.5CVE-2026-62775EPSS 0.4%

    Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.

  27. 7.8CVE-2026-61925EPSS 0.3%

    Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

  28. 6.5CVE-2026-48375EPSS 0.8%

    ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service c…

  29. 7.8CVE-2026-25652EPSS 0.2%

    is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not r…

  30. 8.1CVE-2026-72921EPSS 0.4%

    SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling p…

  31. 7.2CVE-2026-18635EPSS 0.5%

    Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administra…

  32. 9.3CVE-2026-72785EPSS 0.3%

    Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's categor…

  33. 7.1CVE-2026-72771EPSS 0.4%

    n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared cred…

  34. 9.2CVE-2026-13738EPSS 0.7%

    CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webse…

  35. 9.2CVE-2026-13737EPSS 0.7%

    CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Cente…

  36. 4.1CVE-2026-18348EPSS 0.3%

    Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NE…

  37. 8.6CVE-2025-30238EPSS 0.2%

    In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged ac…

  38. 9.9CVE-2026-72886EPSS 0.5%

    Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the o…

  39. 8.7CVE-2026-69118EPSS 0.8%

    Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directi…

  40. 4.3CVE-2026-12624EPSS 0.3%

    Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny …

  41. 6.9CVE-2026-21077EPSS 0.1%

    Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

  42. 6.9CVE-2026-21076EPSS 0.1%

    Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

  43. 5.5CVE-2026-18934EPSS 0.3%

    The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete th…

  44. 5.3CVE-2026-15229EPSS 0.3%

    The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific p…

  45. 5.3CVE-2026-19350EPSS 0.3%

    A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performe…

  46. 5.5CVE-2026-19345EPSS 0.5%

    A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to la…

  47. 7.1CVE-2026-45808EPSS 0.4%

    OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying creden…

  48. 4.0CVE-2026-71381EPSS 0.3%

    Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain …

  49. 2.3CVE-2026-66000EPSS 0.4%

    Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced …

  50. 8.2CVE-2026-17594ExploitEPSS 1.0%

    Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped …