Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
4,278 results · Feed
-
High 8.8
Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass …
-
Critical 9.0
Certificate Name Authorization Bypass
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authori…
-
Critical 9.1
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePe…
-
Medium 6.5
Authenticated Authorization Bypass in the API of HPE Networking Fabric Composer
An authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker to bypass security restrictions and modify protected resources on the affected system.
-
High 7.3
traQ: Privilege escalation by OAuth prompt=none request
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all sc…
-
Medium 5.4
NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbi…
-
Medium 4.3
Incorrect Authorization in Elasticsearch Leading to Information Disclosure
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value…
-
Medium 5.7
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that…
-
Medium 5.3
CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as email…
-
High 8.8
smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign the…
-
Medium 4.3
SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-te…
-
Low 3.1
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers…
-
Medium 5.4
Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring ale…
-
Low 3.8
weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authori…
-
High 8.7
Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s prov…
-
Medium 4.0
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. Th…
-
Medium 4.3
Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unp…
-
High 7.2
LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/se…
-
Medium 4.3
LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send…
-
High 8.8
madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platf…
-
Medium 4.3
Gitea user and organization feed token scope bypass
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and t…
-
High 7.5
Gitea public-only token bypass on bulk organization repository deletion
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public org…
-
Medium 4.3
Gitea OAuth2 userinfo private group disclosure to public-only tokens
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the r…
-
Critical 9.1
Gitea public-only package token access to private OCI blobs
The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope…
-
Critical 9.1
Gitea public-only token bypass through Actions runner registration
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only …
-
Medium 6.5
Gitea Actions fork workflow trust through pull request review commit
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read ac…
-
Medium 6.5
epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission …
-
High 8.7
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to…
-
High 7.6
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify sessio…
-
High 8.3
IXP Manager has Broken Object-Level Authorization
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` s…
-
Medium 5.3
ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different accou…
-
High 8.2
Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented two-workflow pattern,…
-
Medium 6.5
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In `internal/database/s…
-
High 8.1
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the admin…
-
High 8.7
Secret Server JWT issuance error
In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
-
Medium 6.5
HotCRP: comment-author search exposes anonymous commenter identities
HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper …
-
Medium 6.5
Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies…
-
Medium 4.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
-
Medium 5.0
SecureDrop: API session token reuse against the Journalist Interface web UI
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token agai…
-
High 8.3
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in pos…