Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
2,076 results · Clear filters · Feed
-
Medium 6.5
Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information…
-
Medium 6.9
Sandboxie-Plus: Sandbox containment bypass
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing…
-
Medium 4.3
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X…
-
Medium 6.3
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x…
-
Medium 6.5
Tanium addressed an improper access controls vulnerability in Enforce.
Tanium addressed an improper access controls vulnerability in Enforce.
-
Medium 4.2
Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover.
-
Medium 5.6
Bake filesystem path entitlements approval can be skipped in some multi-target builds
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some …
-
Medium 5.4
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin…
-
Medium 5.1
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engi…
-
Medium 6.5
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social …
-
Medium 6.5
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soc…
-
Medium 4.3
Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolati…
-
Medium 4.3
Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acc…
-
Medium 4.3
Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social …
-
Medium 5.4
Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI eleme…
-
Medium 4.3
Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acces…
-
Medium 4.3
Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging …
-
Medium 5.3
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compro…
-
Medium 6.5
Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker …
-
Medium 6.5
Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging…
-
Medium 6.5
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross…
-
Medium 6.5
Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system …
-
Medium 6.5
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cros…
-
Medium 5.3
Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain se…
-
Medium 6.5
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acces…
-
Medium 6.5
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass syste…
-
Medium 6.5
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soci…
-
Medium 6.5
Authenticated Authorization Bypass in the API of HPE Networking Fabric Composer
An authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker to bypass security restrictions and modify protected resources on the affected system.
-
Medium 5.4
NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbi…
-
Medium 4.3
Incorrect Authorization in Elasticsearch Leading to Information Disclosure
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value…
-
Medium 5.7
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that…
-
Medium 5.3
CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as email…
-
Medium 4.3
SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-te…
-
Medium 5.4
Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring ale…
-
Medium 4.0
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. Th…
-
Medium 4.3
Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unp…
-
Medium 4.3
LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send…
-
Medium 4.3
Gitea user and organization feed token scope bypass
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and t…
-
Medium 4.3
Gitea OAuth2 userinfo private group disclosure to public-only tokens
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the r…
-
Medium 6.5
Gitea Actions fork workflow trust through pull request review commit
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read ac…