cve.bz

CWE-863: Incorrect Authorization, page 8

Filter

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

What the weakness is: CWE-863 at MITRE

Ask an AI about CWE-863

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-863: Incorrect Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/863.html and https://cve.bz/cve/cwe/863?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.4CVE-2026-109559EPSS 0.3%

    EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-ser…

  2. 5.3CVE-2026-109376EPSS 0.3%

    ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_time…

  3. 7.0CVE-2026-104355EPSS 0.4%

    A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, …

  4. 9.9CVE-2026-77366EPSS 0.3%

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) h…

  5. 5.1CVE-2026-109374EPSS 0.2%

    ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers hol…

  6. 5.3CVE-2026-109336EPSS 0.2%

    SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unredu…

  7. 6.3CVE-2026-109302EPSS 0.2%

    Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cach…

  8. 5.3CVE-2026-109287EPSS 0.3%

    Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can…

  9. 2.3CVE-2026-109285EPSS 0.2%

    Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or w…

  10. 5.3CVE-2026-109283EPSS 0.3%

    Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found,…

  11. 8.6CVE-2026-92682EPSS 0.3%

    In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of …

  12. 5.3CVE-2026-109182EPSS 0.2%

    jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or depart…

  13. 5.3CVE-2026-109181EPSS 0.2%

    jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0…

  14. 7.1CVE-2026-109174EPSS 0.2%

    MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve…

  15. 7.1CVE-2026-108951EPSS 0.3%

    LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request…

  16. 9.1CVE-2026-85499EPSS 0.3%

    Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable m…

  17. 8.7CVE-2026-103903EPSS 0.4%

    An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy …

  18. 5.4CVE-2026-107203EPSS 0.2%

    An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on…

  19. 8.7CVE-2026-108746EPSS 0.4%

    Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert an…

  20. 8.2CVE-2026-108729EPSS 0.3%

    Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. …

  21. 5.3CVE-2026-108711EPSS 0.3%

    Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because get_or_create_workspace checks only the workspace claim. Attackers can s…

  22. 9.1CVE-2026-81649EPSS 0.3%

    The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to…

  23. 2.7CVE-2026-107507EPSS 0.2%

    The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and dat…

  24. 7.1CVE-2026-108695EPSS 0.3%

    MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POS…

  25. 5.8CVE-2026-108604EPSS 0.2%

    Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements…

  26. 6.0CVE-2026-108595EPSS 0.3%

    Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected inst…

  27. 5.3CVE-2026-108586EPSS 0.2%

    1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a sin…

  28. 8.7CVE-2026-108550EPSS 0.3%

    SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the me…

  29. 5.3CVE-2026-108114EPSS 0.2%

    Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeilin…

  30. 4.7CVE-2026-105976EPSS 0.2%

    The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well …

  31. 5.3CVE-2026-6723EPSS 0.2%

    The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API en…

  32. 9.9CVE-2026-108263EPSS 0.4%

    Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/…

  33. 4.3CVE-2026-107851EPSS 0.2%

    Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the u…

  34. 5.7CVE-2026-107841EPSS 0.2%

    pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent establish…

  35. 6.4CVE-2026-107822EPSS 0.5%

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user na…

  36. 7.2CVE-2026-78341EPSS 0.3%

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Eleva…

  37. 6.0CVE-2026-101028EPSS 0.3%

    Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) appli…

  38. 7.5CVE-2026-107728EPSS 0.4%

    Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares…

  39. 8.5CVE-2026-107782EPSS 0.1%

    System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code int…

  40. 5.3CVE-2026-107706EPSS 0.2%

    Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST…

  41. 7.2CVE-2026-97147EPSS 0.3%

    In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publ…

  42. 6.0CVE-2026-93861EPSS 0.3%

    In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its …

  43. 6.5CVE-2026-107336EPSS 0.2%

    Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) en…

  44. 5.4CVE-2026-107334EPSS 0.2%

    Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the r…

  45. 8.1CVE-2026-107333EPSS 1.2%

    Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a special…

  46. 6.5CVE-2026-50055EPSS 0.4%

    A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.

  47. 6.5CVE-2026-14273EPSS 0.09%

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.

  48. 6.5CVE-2026-71896EPSS 0.3%

    An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails…

  49. 7.1CVE-2026-71183EPSS 0.2%

    An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpo…

  50. 8.1CVE-2026-66087EPSS 0.3%

    An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the  * /dolphinscheduler/projects/{projectCode}/task-instanc…