CWE-285 · Improper Authorization (page 4)
Page 4 of 16 — CVEs classified under CWE-285, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7091 | Medium | 6.3 | 2026-04-27 | A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handl… |
CVE-2026-6977 | High | 7.3 | 2026-04-25 | A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The ma… |
CVE-2025-67259 | Medium | 6.5 | 2026-04-24 | A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level i… |
CVE-2026-34321 | Medium | 4.8 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interf… |
CVE-2026-34320 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interface). The supporte… |
CVE-2026-34315 | Medium | 6.5 | 2026-04-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-6634 | Medium | 6.3 | 2026-04-20 | A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInst… |
CVE-2026-6614 | Medium | 6.3 | 2026-04-20 | A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_… |
CVE-2026-6613 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file s… |
CVE-2026-6612 | Medium | 6.3 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file su… |
CVE-2026-6609 | Medium | 6.3 | 2026-04-20 | A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation o… |
CVE-2026-6586 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/… |
CVE-2026-6585 | Medium | 5.4 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controller… |
CVE-2026-6584 | Medium | 5.4 | 2026-04-20 | A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/use… |
CVE-2026-6583 | Medium | 5.4 | 2026-04-19 | A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controll… |
CVE-2026-6572 | Medium | 5.6 | 2026-04-19 | A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controlle… |
CVE-2026-6571 | Medium | 6.3 | 2026-04-19 | A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/s… |
CVE-2026-6570 | Low | 2.7 | 2026-04-19 | A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php… |
CVE-2026-6564 | Medium | 4.3 | 2026-04-19 | A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation r… |
CVE-2026-40305 | Medium | 4.3 | 2026-04-17 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10… |
CVE-2026-40259 | High | 8.1 | 2026-04-16 | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by… |
CVE-2026-40248 | High | 7.5 | 2026-04-16 | free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for creating or updating Traffic I… |
CVE-2026-40247 | High | 7.5 | 2026-04-16 | free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for reading Traffic Influence Subs… |
CVE-2026-40246 | High | 7.5 | 2026-04-16 | free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Sub… |
CVE-2026-34370 | Medium | 6.5 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (ID… |
CVE-2026-33146 | Medium | 4.3 | 2026-04-14 | Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricte… |
CVE-2026-27912 | High | 8.0 | 2026-04-14 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-38533 | Medium | 6.5 | 2026-04-14 | An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to… |
CVE-2026-6105 | High | 7.3 | 2026-04-11 | A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller… |
CVE-2026-32252 | High | 7.7 | 2026-04-10 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant a… |
CVE-2026-5412 | Critical | 9.9 | 2026-04-10 | In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to… |
CVE-2026-5999 | Medium | 6.3 | 2026-04-10 | A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads t… |
CVE-2026-5842 | High | 7.3 | 2026-04-09 | A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Admin… |
CVE-2026-39901 | Medium | 5.7 | 2026-04-08 | monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user… |
CVE-2026-35479 | Medium | 6.6 | 2026-04-08 | InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API… |
CVE-2026-35476 | High | 7.2 | 2026-04-08 | InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level vi… |
CVE-2026-35407 | Medium | 6.5 | 2026-04-08 | Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found in the acco… |
CVE-2026-39389 | Medium | 6.7 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-39347 | Low | 2.7 | 2026-04-07 | OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for a… |
CVE-2026-35610 | High | 8.8 | 2026-04-07 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(userId) in the accou… |
CVE-2026-5642 | High | 7.3 | 2026-04-06 | A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the f… |
CVE-2026-5529 | Medium | 4.3 | 2026-04-05 | A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component… |
CVE-2017-20238 | High | 7.1 | 2026-04-03 | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only… |
CVE-2026-33105 | Critical | 10.0 | 2026-04-03 | Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32213 | Critical | 10.0 | 2026-04-03 | Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-33950 | Critical | 9.4 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by… |
CVE-2026-5326 | Medium | 5.3 | 2026-04-02 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the c… |
CVE-2026-5246 | Medium | 5.6 | 2026-04-02 | A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-… |
CVE-2026-34222 | High | 7.7 | 2026-04-01 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vu… |
CVE-2026-5283 | Medium | 6.5 | 2026-04-01 | Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-34738 | Medium | 4.3 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that a… |
CVE-2026-34784 | High | 7.5 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downlo… |
CVE-2026-33074 | Medium | 5.3 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32619 | Medium | 4.3 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-32615 | Medium | 5.4 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-4818 | Medium | 6.8 | 2026-03-31 | In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management opera… |
CVE-2026-1710 | Medium | 6.5 | 2026-03-31 | The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2026-32716 | High | 8.1 | 2026-03-31 | SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple p… |
CVE-2026-30878 | Medium | 5.3 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, a public mail submission API allows unauthenticated users to submit mail form entries even… |
CVE-2026-4248 | High | 8.0 | 2026-03-27 | The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{use… |
CVE-2026-4990 | High | 7.3 | 2026-03-27 | A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup… |
CVE-2026-33954 | Medium | 6.5 | 2026-03-27 | LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a diff… |
CVE-2026-4958 | Low | 3.1 | 2026-03-27 | A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/appli… |
CVE-2026-33735 | High | 8.8 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database… |
CVE-2026-21724 | Medium | 5.4 | 2026-03-26 | A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify… |
CVE-2026-34056 | High | 7.7 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to… |
CVE-2026-34051 | Medium | 5.4 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access cont… |
CVE-2026-33222 | Medium | 4.9 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admi… |
CVE-2026-28881 | Medium | 5.5 | 2026-03-25 | A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data. |
CVE-2026-28865 | High | 7.5 | 2026-03-25 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequ… |
CVE-2026-28845 | Medium | 5.5 | 2026-03-25 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access protected user data. |
CVE-2026-28839 | Medium | 5.3 | 2026-03-25 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access… |
CVE-2026-33162 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move en… |
CVE-2026-33680 | High | 7.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated user… |
CVE-2026-33668 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locke… |
CVE-2026-4617 | High | 7.3 | 2026-03-24 | A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the f… |
CVE-2026-32300 | High | 8.1 | 2026-03-23 | Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0… |
CVE-2025-10731 | Medium | 5.3 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive I… |
CVE-2025-10736 | Medium | 6.5 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorize… |
CVE-2026-4563 | Medium | 4.3 | 2026-03-23 | A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User… |
CVE-2026-4549 | Low | 3.1 | 2026-03-22 | A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-p… |
CVE-2026-4548 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/upda… |
CVE-2026-2294 | Medium | 4.3 | 2026-03-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2026-33186 | Critical | 9.1 | 2026-03-20 | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2… |
CVE-2026-31836 | High | 8.1 | 2026-03-20 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-33125 | High | 7.1 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can del… |
CVE-2026-31869 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals… |
CVE-2026-30702 | Critical | 9.8 | 2026-03-18 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does no… |
CVE-2026-32692 | High | 7.6 | 2026-03-18 | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to… |
CVE-2026-21886 | Medium | 6.5 | 2026-03-17 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualD… |
CVE-2026-3237 | Medium | 4.3 | 2026-03-17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocati… |
CVE-2026-4171 | Medium | 6.3 | 2026-03-16 | A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file ex… |
CVE-2026-32704 | Medium | 6.5 | 2026-03-16 | SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to… |
CVE-2026-4013 | Medium | 6.3 | 2026-03-12 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php… |
CVE-2026-28806 | High | 8.8 | 2026-03-10 | Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API. Miss… |
CVE-2026-30959 | Medium | 5.0 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verificat… |
CVE-2026-30956 | Critical | 9.9 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in O… |
CVE-2026-30870 | Medium | 6.5 | 2026-03-10 | PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain sub… |
CVE-2026-28431 | High | 7.5 | 2026-03-10 | Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerabili… |
CVE-2026-3817 | Medium | 5.3 | 2026-03-09 | A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patie… |