Skip to content
OpenAdvisories

Weakness (CWE)

CWE-863: Incorrect Authorization

Class Incomplete

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-863

All Critical High Medium Low Exploited only Public exploit

2,089 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-57676

    An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unaut…

  • Medium 5.3
    CVE-2024-57680

    An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unaut…

  • Medium 6.4
    CVE-2025-21403

    On-Premises Data Gateway Information Disclosure Vulnerability

    On-Premises Data Gateway Information Disclosure Vulnerability

    Microsoft On-Premises Data Gateway
  • Medium 5.3
    CVE-2024-13302

    Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

    Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

    Drupal Pages Restriction Access drupal/pages_restriction Packagist
  • Medium 5.3
    CVE-2024-13290

    OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056

    Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.

    Drupal OhDear Integration drupal/ohdear_integration Packagist
  • Medium 4.3
    CVE-2024-13271

    Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

    Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.

    Drupal Content Entity Clone drupal/content_entity_clone Packagist
  • Medium 4.3
    CVE-2024-13270

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034

    Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.

    Drupal Freelinking drupal/freelinking Packagist
  • Medium 5.3
    CVE-2024-13266

    Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

    Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

    Drupal Responsive and off-canvas menu drupal/responsive_menu Packagist
  • Medium 5.3
    CVE-2024-13257

    Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

    Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.

    Drupal Commerce View Receipt drupal/commerce_view_receipt Packagist
  • Medium 6.5
    CVE-2024-56114

    Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit …

  • Medium 5.4
    CVE-2025-0237

    WebChannel APIs susceptible to confused deputy attack

    The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 4.0
    CVE-2024-47148

    Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause d…

    Honor Magic OS
  • Medium 5.5
    CVE-2024-47102

    IBM AIX denial of service

    IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service.

    IBM AIX VIOS
  • Medium 4.3
    CVE-2024-56350

    In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects

    JetBrains TeamCity
  • Medium 4.3
    CVE-2024-56348 Public exploit

    In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents

    JetBrains TeamCity
  • Medium 6.6
    CVE-2024-12831

    Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability

    Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low…

    Arista Networks NG Firewall Network devices
  • Medium 4.3
    CVE-2024-55186

    Oqtane Framework Insecure Direct Object Reference vulnerability

    An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker c…

    Oqtane.Framework Oqtane.Server Oqtane.Client Oqtane.Shared NuGet
  • Medium 6.0
    CVE-2024-12539

    Elasticsearch Incorrect Authorization

    An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2024-8116

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2024-8650

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.5
    CVE-2024-54495

    The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2…

    Apple macOS macOS
  • Medium 4.6
    CVE-2024-12247

    Improper propagation of permission scheme updates across cluster nodes

    Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.

    Mattermost Mattermost
  • Medium 4.3
    CVE-2024-12148

    Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authe…

    Devolutions Server
  • Medium 6.5
    CVE-2024-12196

    Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticate…

    Devolutions Server
  • Medium 4.3
    CVE-2023-52944

    Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-1128…

    Synology Surveillance Station
  • Medium 4.3
    CVE-2023-52943

    Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-1…

    Synology Surveillance Station
  • Medium 6.5
    CVE-2024-11669

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.4
    CVE-2024-11670

    Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earl…

    Devolutions Remote Desktop Manager
  • Medium 4.3
    CVE-2024-11672

    Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on …

    Devolutions Remote Desktop Manager
  • Medium 4.3
    CVE-2024-50671

    Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User role…

  • Medium 5.3
    CVE-2024-11176

    Incorrect evaluation of effective permissions in M-Files Aino

    Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.

    M-Files M-Files Aino
  • Medium 4.9
    CVE-2024-52584

    Autolab has vulnerable submission endpoints

    Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The…

    autolab Autolab
  • Medium 4.3
    CVE-2024-48901

    Moodle: idor when fetching report schedules

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2024-48897

    Moodle: idor in edit/delete rss feed

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.4
    CVE-2022-31667

    Harbor fails to validate the user permissions when updating a robot account

    Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.  By sending a request that attempts to update a robot account, and specifying a robot account id and robo…

    github.com/goharbor/harbor Go
  • Medium 6.4
    CVE-2022-31669

    Harbor fails to validate the user permissions when updating tag immutability policies

    Harbor fails to validate the user permissions when updating tag immutability policies.  By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker co…

    github.com/goharbor/harbor Go
  • Medium 5.3
    CVE-2024-8001

    VIWIS LMS Print authorization

    A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the rol…

    VIWIS LMS
  • Medium 6.5
    CVE-2024-45877

    baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /App…

  • Medium 5.3
    CVE-2024-43433

    Moodle: matrix user/power level management not always working as expected with suspended users

    A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.9
    CVE-2024-52314

    data.all admin user may access potentially sensitive data stored by producers via logs

    A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with custo…

    amazon data.all