cve.bz

CWE-863: Incorrect Authorization, page 5

Filter

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

Ask an AI about CWE-863

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-863: Incorrect Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/863.html and https://cve.bz/cve/cwe/863?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.1CVE-2026-97204EPSS 0.2%

    Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the label…

  2. 5.3CVE-2026-112047EPSS 0.2%

    OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI acce…

  3. 8.6CVE-2026-112001EPSS 0.6%

    ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_user…

  4. 5.5CVE-2026-110032EPSS 0.2%

    The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any o…

  5. 2.0CVE-2026-111875EPSS 0.2%

    A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such…

  6. 6.0CVE-2026-111929EPSS 0.2%

    Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archi…

  7. 5.3CVE-2026-111928EPSS 0.1%

    Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does…

  8. 5.3CVE-2026-111921EPSS 0.2%

    Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers …

  9. 5.3CVE-2026-111918EPSS 0.2%

    Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attack…

  10. 5.3CVE-2026-111900EPSS 0.3%

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated user…

  11. 5.1CVE-2026-111888EPSS 0.3%

    phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT.…

  12. 4.3CVE-2026-96628EPSS 0.2%

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired…

  13. 7.6CVE-2026-111044EPSS 0.2%

    Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certifi…

  14. 8.1CVE-2026-61726EPSS 0.3%

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the priva…

  15. 5.3CVE-2026-111688EPSS 0.3%

    Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByPar…

  16. 5.3CVE-2026-111666EPSS 0.3%

    Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space fil…

  17. 8.6CVE-2026-111627EPSS 0.6%

    HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and…

  18. 9.3CVE-2026-109587EPSS 0.1%

    Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned …

  19. 8.8CVE-2026-97380EPSS 1.3%

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication w…

  20. 8.2CVE-2026-86009EPSS 0.4%

    Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enabl…

  21. 7.8CVE-2026-88755EPSS 0.2%

    Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

  22. 6.5CVE-2026-110806EPSS 0.2%

    Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

  23. 4.3CVE-2026-110287EPSS 0.2%

    Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct reque…

  24. 6.8CVE-2026-106030EPSS 0.10%

    NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process …

  25. 4.9CVE-2026-19076EPSS 0.2%

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a targ…

  26. 4.3CVE-2026-18256EPSS 0.2%

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private tea…

  27. 5.0CVE-2026-18223EPSS 0.2%

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to …

  28. 6.5CVE-2026-18551EPSS 0.2%

    Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or cha…

  29. 2.7CVE-2026-110039EPSS 0.2%

    The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

  30. 6.5CVE-2026-109382EPSS 0.3%

    The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement…

  31. 8.6CVE-2026-111446EPSS 0.3%

    Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 t…

  32. 7.1CVE-2026-111369EPSS 0.2%

    ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary le…

  33. 8.7CVE-2026-111352EPSS 0.5%

    ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule…

  34. 6.3CVE-2026-111332EPSS 0.3%

    OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request c…

  35. 8.6CVE-2026-45165EPSS 0.2%

    An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retr…

  36. 9.1CVE-2026-111235EPSS 0.4%

    An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an upper…

  37. 8.6CVE-2026-111231EPSS 0.8%

    Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege.…

  38. 8.6CVE-2026-55103EPSS 0.2%

    Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches t…

  39. 7.1CVE-2026-71490EPSS 0.4%

    OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-conf…

  40. 7.5CVE-2026-110724EPSS 0.3%

    In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the origin…

  41. 9.3CVE-2026-19863EPSS 0.5%

    An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when ident…

  42. 6.9CVE-2026-18662EPSS 0.4%

    In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. R…

  43. 6.9CVE-2026-18659EPSS 0.4%

    In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Method…

  44. 8.8CVE-2026-18661EPSS 0.4%

    In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the sam…

  45. 8.5CVE-2024-22031EPSS 0.4%

    A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gai…

  46. 5.3CVE-2026-110904EPSS 0.3%

    ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.

  47. 7.1CVE-2026-110873EPSS 0.2%

    Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point t…

  48. 9.0CVE-2026-110867EPSS 0.3%

    Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override vari…

  49. 7.2CVE-2026-110850EPSS 0.2%

    n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Messa…

  50. 7.2CVE-2026-110844EPSS 0.3%

    n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workfl…