Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
4,318 results · Feed
-
Medium 5.5
The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2…
-
High 7.6
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to …
-
High 8.8
An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network…
-
Medium 4.6
Improper propagation of permission scheme updates across cluster nodes
Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.
-
Medium 4.3
Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authe…
-
Medium 6.5
Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticate…
-
Medium 4.3
Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-1128…
-
Medium 4.3
Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-1…
-
High 7.7
A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak …
-
High 7.7
A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. T…
-
High 8.8
A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode an…
-
High 8.1
Apache Ozone: Improper authentication when generating S3 secrets
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The…
-
High 8.8
An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. A remote…
-
High 8.8
An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELN…
-
Critical 9.1
Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system be…
-
High 7.5
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to a…
-
High 7.5CVE-2024-48651 Scanner template
In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of t…
-
High 8.8
In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen.
-
High 7.8
In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. This could lead to local esc…
-
Medium 6.5
Incorrect Authorization in GitLab
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token …
-
High 7.8
macOS Sensei Mac Cleaner Local Privilege Escalation via PID Reuse - Race Condition Attack
The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. These operations include arbitrary file deletion and writing, loading and unloading daemons, manipula…
-
Medium 5.4
Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earl…
-
Medium 4.3
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on …
-
Medium 4.3
Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User role…
-
Medium 5.3
Incorrect evaluation of effective permissions in M-Files Aino
Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.
-
High 7.5CVE-2024-21287 Exploited
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Pr…
KEV Nov 21, 2024 -
Medium 4.9
Autolab has vulnerable submission endpoints
Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The…
-
Medium 4.3
Moodle: idor when fetching report schedules
A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.
-
Medium 6.5
Moodle: idor in edit/delete rss feed
A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.
-
High 7.5
The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user info…
-
High 7.5
python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of u…
-
Critical 9.6
Incorrect Authorization in lunary-ai/lunary
In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for projects they do not have access to. Specifically, a user with a 'Member' role can issue a request to regen…
-
Medium 6.4
Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robo…
-
Medium 6.4
Harbor fails to validate the user permissions when updating tag immutability policies
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker co…
-
High 7.7
Harbor fails to validate the user permissions when updating tag retention policies
Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could mo…
-
High 7.4
Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticat…
-
High 8.5
Incorrect Authorization in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster un…
-
Critical 9.8
A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attacke…
-
Medium 5.3
VIWIS LMS Print authorization
A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the rol…
-
Medium 6.5
baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /App…