CWE-285 · Improper Authorization

1501 CVEs classified under CWE-285 (Improper Authorization). Browse by severity and year.

Top CVEs for CWE-285
CVESeverityScorePublishedSummary
CVE-2026-33105Critical10.02026-04-03Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-32213Critical10.02026-04-03Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-65041Critical10.02025-12-18Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2023-33189Critical10.02023-05-30Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue…
CVE-2022-2595Critical10.02022-08-01Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
CVE-2022-21196Critical10.02022-02-18MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo…
CVE-2021-37705Critical10.02021-08-13OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authe…
CVE-2021-28799Critical10.02021-05-13An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote…
CVE-2016-5788Critical10.02016-11-25General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote a…
CVE-2026-34048Critical9.92026-07-07Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap route…
CVE-2026-47744Critical9.92026-05-29Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to t…
CVE-2026-5412Critical9.92026-04-10In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to…
CVE-2026-30956Critical9.92026-03-10OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in O…
CVE-2025-49746Critical9.92025-07-18Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
CVE-2025-29827Critical9.92025-05-08Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
CVE-2025-30390Critical9.92025-04-30Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
CVE-2024-45387Critical9.92024-12-23An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operation…
CVE-2024-43602Critical9.92024-11-12Azure CycleCloud Remote Code Execution Vulnerability
CVE-2024-25108Critical9.92024-02-12Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to acce…
CVE-2024-24830Critical9.92024-02-08OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i…
All CVEs classified under CWE-285 — newest first (page 1 of 16)
CVESeverityScorePublishedSummary
CVE-2026-19997Medium4.72026-08-17A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the comp…
CVE-2026-19994Medium6.32026-08-17A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management…
CVE-2026-19986Medium5.42026-08-17A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file cont…
CVE-2026-19979High8.32026-08-17A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20…
CVE-2026-19966Medium5.42026-08-17A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_conta…
CVE-2026-16879High8.82026-08-14IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-sup…
CVE-2026-19838Medium4.32026-08-14A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the co…
CVE-2026-19836Medium4.32026-08-14A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th…
CVE-2026-19834Medium4.72026-08-14A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component…
CVE-2026-19784Medium4.32026-08-14A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation caus…
CVE-2026-734212026-08-13NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existe…
CVE-2026-18509High8.22026-08-13IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the att…
CVE-2026-73644Critical9.62026-08-13OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se…
CVE-2026-3835Medium5.32026-08-13The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token vali…
CVE-2026-10543High8.22026-08-12IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.
CVE-2026-72786Medium6.52026-08-12Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords…
CVE-2026-18499High8.12026-08-12IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-18144Medium4.32026-08-12IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
CVE-2026-72907Medium6.52026-08-10ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts th…
CVE-2026-476632026-08-07Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa…
CVE-2026-59118Critical9.32026-08-07Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-19066Medium4.32026-08-06A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students…
CVE-2026-19064Medium4.32026-08-06A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php…
CVE-2026-18367Critical9.32026-08-06A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos…
CVE-2026-19006Medium6.32026-08-06A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exe…
CVE-2026-18998Medium6.32026-08-06A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the c…
CVE-2026-18997Medium6.32026-08-06A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts o…
CVE-2026-18992Medium6.32026-08-06A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of…
CVE-2026-70442Medium4.32026-08-05Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Ite…
CVE-2026-18818Medium6.32026-08-04A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the…
CVE-2026-18817Low2.22026-08-04A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/sr…
CVE-2026-704722026-08-04Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accep…
CVE-2026-18773Medium6.32026-08-04A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py…
CVE-2026-18723Medium6.32026-08-04A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-sta…
CVE-2026-18722Medium6.32026-08-04A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw…
CVE-2026-18720Medium5.32026-08-04A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the compone…
CVE-2026-481152026-08-03Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerabi…
CVE-2026-18631Medium6.32026-08-03A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/jav…
CVE-2026-18584Medium5.42026-08-03A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /…
CVE-2026-67332Medium6.42026-08-01@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelate…
CVE-2026-14538High7.72026-07-31An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1…
CVE-2026-484992026-07-30Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated…
CVE-2026-23981Medium4.32026-07-30An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do…
CVE-2026-41187Medium6.52026-07-30Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNet…
CVE-2026-66488Medium5.32026-07-29Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVE-2026-18207Medium6.52026-07-29A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique i…
CVE-2026-477262026-07-28nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog…
CVE-2026-61487Medium6.52026-07-28Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-de…
CVE-2026-64743Medium6.52026-07-27An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tah…
CVE-2026-64711Medium5.52026-07-27This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS…
CVE-2026-43792Medium6.52026-07-27An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.6, macOS Tahoe 26.6. An app may be able to access sensiti…
CVE-2026-43775Medium5.52026-07-27An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app may be able to acces…
CVE-2026-43756Medium5.52026-07-27A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to…
CVE-2026-64642High8.22026-07-27Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications usin…
CVE-2026-17531Medium5.02026-07-27A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts…
CVE-2026-17530Medium6.32026-07-27A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr…
CVE-2026-17529Medium6.32026-07-27A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati…
CVE-2026-17434Medium6.32026-07-26A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the compone…
CVE-2026-17433Medium5.32026-07-26A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts…
CVE-2026-62835Critical9.32026-07-24Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
CVE-2026-56160Critical9.12026-07-24Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
CVE-2026-62563Medium5.42026-07-21Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2…
CVE-2026-62444Medium6.12026-07-21Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar…
CVE-2026-61082Medium6.52026-07-21Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitab…
CVE-2026-60957Medium5.42026-07-21Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected…
CVE-2026-60911Medium5.42026-07-21Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12…
CVE-2026-60886High7.62026-07-21Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2…
CVE-2026-60844High8.12026-07-21Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update Service Request). Supported versions that are affected are…
CVE-2026-60842Medium6.12026-07-21Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Search). Supported versions that are affected are 12.2.5-12.2…
CVE-2026-60152Medium5.42026-07-21Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6…
CVE-2026-47053Medium5.62026-07-21Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploi…
CVE-2026-28312Critical9.12026-07-21SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as…
CVE-2026-16450Medium4.32026-07-21A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/s…
CVE-2026-342392026-07-20Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected o…
CVE-2026-32821High8.12026-07-20dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p…
CVE-2026-32819Medium4.32026-07-20dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p…
CVE-2026-32806High7.52026-07-20dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p…
CVE-2026-32807High7.52026-07-20dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p…
CVE-2026-278232026-07-20A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary…
CVE-2026-63752Medium4.32026-07-20SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwri…
CVE-2026-16224Medium4.32026-07-19A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component A…
CVE-2026-16217Medium6.32026-07-19A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/de…
CVE-2026-16214Medium6.32026-07-19A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashbo…
CVE-2026-16200High7.32026-07-19A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the compone…
CVE-2026-16199Medium6.32026-07-19A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed…
CVE-2026-16195Medium6.32026-07-18A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of…
CVE-2026-16126High7.32026-07-18A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c o…
CVE-2026-16122Medium4.32026-07-18A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesA…
CVE-2026-16121Medium6.32026-07-18A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The man…
CVE-2026-16119Medium6.32026-07-18A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the…
CVE-2024-58367Medium6.52026-07-18SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access un…
CVE-2026-16075Medium4.32026-07-18A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard…
CVE-2026-49977Medium4.32026-07-17tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class an…
CVE-2026-61718Medium5.42026-07-16bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization b…
CVE-2026-15909Medium6.32026-07-16A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/a…
CVE-2026-53515High7.12026-07-15Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint…
CVE-2026-45337High7.62026-07-15Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated ses…
CVE-2026-49997Medium5.42026-07-15SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/…
CVE-2026-58540High7.82026-07-14Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-58277High8.82026-07-14Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.