Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
4,277 results · Feed
-
High 7.1
In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script discl…
-
Medium 6.4
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
-
High 7.7
In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
-
Low 3.1
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
-
High 8.1
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoi…
-
High 7.5
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
-
Medium 5.4
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
-
Medium 5.9
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
-
Medium 5.9
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published int…
-
Medium 6.5
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify…
-
High 8.1
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
-
Critical 9.0
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
-
Medium 5.3
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscri…
-
Medium 4.9
PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed po…
-
Medium 4.3
Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this …
-
Critical 9.0
Subnet Solutions PowerSYSTEM Center Incorrect Authorization
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
-
Medium 6.5
Dagu MCP DAG specification read bypasses path containment and workspace isolation
Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP dagu_read operation with target dag_spec invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying…
-
High 7.2
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and del…
-
Medium 6.8
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2…
-
Critical 9.0
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api…
-
Medium 6.5
SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_rev…
-
Medium 6.5
SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by…
-
High 7.2
Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level o…
-
High 8.8
Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to …
-
Medium 5.4
Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a diff…
-
High 7.3
agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of t…
-
Low 2.7
Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite…
-
Medium 6.5
Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information…
-
High 7.7
Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling
Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind …
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced Cleanup…
-
High 7.7
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds…
-
Medium 6.9
Sandboxie-Plus: Sandbox containment bypass
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing…
-
Medium 4.3
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X…
-
High 7.1
GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities inst…
-
Medium 6.3
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x…
-
High 8.6
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principa…
-
High 8.8
Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persi…
-
High 8.8
Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability
Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to e…
-
Medium 6.5
Tanium addressed an improper access controls vulnerability in Enforce.
Tanium addressed an improper access controls vulnerability in Enforce.
-
Medium 4.2
Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover.