Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
1,439 results · Clear filters · Feed
-
High 8.8
Adobe Connect | Incorrect Authorization (CWE-863)
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this…
-
High 7.7
Audition | Incorrect Authorization (CWE-863)
Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the…
-
High 7.7
Media Encoder | Incorrect Authorization (CWE-863)
Media Encoder is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user inter…
-
High 8.3
Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dis…
-
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Text Services Framework Elevation of Privilege Vulnerability
Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows AppX Deployment Service Elevation of Privilege Vulnerability
Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
-
High 8.3
Visual Studio Code Remote Code Execution Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 7.8
Visual Studio Code Security Feature Bypass Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 8.8
Windows Active Directory Domain Services Remote Code Execution Vulnerability
Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.1
Windows Kernel Security Feature Bypass Vulnerability
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.
-
High 7.8
Windows Clipboard Virtual Channel Extension Elevation of Privilege Vulnerability
Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 8.6
In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provide…
-
High 7.1
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via…
-
High 7.5
An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS…
-
High 8.1
SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn …
-
High 8.6
Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql
Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt w…
-
High 7.2
Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions,…
-
High 7.5
IBM App Connect Enterprise is vulnerable to a credential exposure
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.
-
High 8.3
OpenEMR before 8.4.0 Improper Authorization via Prescription REST API
OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Aut…
-
High 8.0
OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /co…
-
High 8.1
WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoint…
-
High 7.7
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
-
High 7.7
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
-
High 8.1
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.
-
High 7.4
In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
-
High 8.2
Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.hea…
-
High 7.1
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script discl…
-
High 7.7
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
-
High 8.1
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoi…
-
High 7.5
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
-
High 8.1
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
-
High 7.2
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and del…
-
High 7.2
Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level o…
-
High 8.8
Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to …
-
High 7.3
agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of t…