CWE-863 · Incorrect Authorization (page 10)
Page 10 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24692 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows gues… |
CVE-2026-22545 | Low | 3.1 | 2026-03-16 | Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated at… |
CVE-2026-4265 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to… |
CVE-2026-32717 | Low | 2.7 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, in multi-use… |
CVE-2026-32715 | Low | 3.8 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The two gene… |
CVE-2026-2462 | Medium | 6.6 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin creden… |
CVE-2026-20992 | Low | 3.3 | 2026-03-16 | Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application. |
CVE-2026-32597 | High | 7.5 | 2026-03-13 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11… |
CVE-2026-30943 | Medium | 4.1 | 2026-03-13 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file r… |
CVE-2026-32245 | Medium | 6.5 | 2026-03-12 | Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging an authorization cod… |
CVE-2026-3977 | Medium | 6.3 | 2026-03-12 | A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipul… |
CVE-2026-32123 | High | 7.7 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, sensitivity checks for group encount… |
CVE-2026-32108 | Medium | 6.5 | 2026-03-11 | Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability o… |
CVE-2026-32102 | Medium | 6.5 | 2026-03-11 | OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and… |
CVE-2026-32101 | High | 7.6 | 2026-03-11 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is decl… |
CVE-2026-31887 | High | 7.5 | 2026-03-11 | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to… |
CVE-2026-30239 | Medium | 6.5 | 2026-03-11 | OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this b… |
CVE-2026-30236 | Medium | 4.3 | 2026-03-11 | OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not ch… |
CVE-2026-1524 | Critical | 9.8 | 2026-03-11 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions… |
CVE-2026-1471 | Medium | 6.5 | 2026-03-11 | Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the… |
CVE-2025-12555 | Medium | 4.3 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain c… |
CVE-2026-31892 | High | 8.1 | 2026-03-11 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user… |
CVE-2026-28229 | Critical | 9.8 | 2026-03-11 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates… |
CVE-2026-1497 | High | 7.2 | 2026-03-11 | Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: … |
CVE-2026-32059 | High | 8.8 | 2026-03-11 | OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allow… |
CVE-2026-21359 | Medium | 4.7 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-21309 | High | 7.5 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-21297 | Medium | 4.3 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-21296 | Medium | 4.3 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-21289 | High | 7.5 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-21286 | Medium | 5.3 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-21285 | Medium | 4.3 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2026-31838 | Medium | 5.3 | 2026-03-10 | Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching coul… |
CVE-2026-31801 | High | 7.7 | 2026-03-10 | zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorizati… |
CVE-2026-30965 | Critical | 9.1 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in P… |
CVE-2026-30947 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissi… |
CVE-2026-26308 | High | 7.5 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains… |
CVE-2026-30945 | High | 7.1 | 2026-03-10 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint… |
CVE-2026-30944 | High | 8.8 | 2026-03-10 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows… |
CVE-2026-26141 | High | 7.8 | 2026-03-10 | Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2026-29773 | Medium | 4.3 | 2026-03-10 | Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionP… |
CVE-2026-28513 | High | 8.5 | 2026-03-10 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an author… |
CVE-2026-30863 | Critical | 9.8 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google… |
CVE-2026-30854 | Medium | 5.3 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alph… |
CVE-2026-29196 | Medium | 4.3 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard con… |
CVE-2026-29195 | Medium | 6.5 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role u… |
CVE-2026-29194 | High | 8.1 | 2026-03-07 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permit… |
CVE-2026-30820 | High | 8.8 | 2026-03-07 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, Flowise trusts any HTTP client that sets the… |
CVE-2026-30241 | High | 8.2 | 2026-03-06 | Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries… |
CVE-2026-30229 | High | 7.2 | 2026-03-06 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnly… |
CVE-2026-30228 | Medium | 4.9 | 2026-03-06 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnly… |
CVE-2026-29182 | High | 7.2 | 2026-03-06 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server… |
CVE-2026-29087 | High | 7.5 | 2026-03-06 | @hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with ro… |
CVE-2026-23925 | High | 8.1 | 2026-03-06 | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to conf… |
CVE-2026-28726 | Medium | 4.3 | 2026-03-06 | Sensitive information disclosure due to improper access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41… |
CVE-2026-28724 | Medium | 4.3 | 2026-03-06 | Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before b… |
CVE-2026-28723 | Medium | 4.3 | 2026-03-06 | Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41… |
CVE-2026-28720 | Medium | 4.3 | 2026-03-06 | Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows)… |
CVE-2026-28719 | Medium | 4.3 | 2026-03-06 | Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before… |
CVE-2026-28716 | Medium | 4.4 | 2026-03-06 | Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) be… |
CVE-2026-28715 | Medium | 6.5 | 2026-03-06 | Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before bu… |
CVE-2026-28709 | Medium | 4.3 | 2026-03-06 | Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before… |
CVE-2026-28474 | Critical | 9.8 | 2026-03-05 | OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, all… |
CVE-2026-28473 | High | 8.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval req… |
CVE-2026-28466 | Critical | 9.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, a… |
CVE-2026-28392 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct mes… |
CVE-2026-28790 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate runn… |
CVE-2026-21621 | Medium | 5.3 | 2026-03-05 | Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with… |
CVE-2026-3009 | High | 8.1 | 2026-03-05 | A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it… |
CVE-2026-3236 | Medium | 4.3 | 2026-03-05 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exc… |
CVE-2026-29127 | High | 7.8 | 2026-03-05 | The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permis… |
CVE-2026-29126 | High | 7.8 | 2026-03-05 | Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a loc… |
CVE-2026-27803 | High | 8.3 | 2026-03-04 | Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=fa… |
CVE-2026-27802 | High | 8.3 | 2026-03-04 | Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalat… |
CVE-2026-26949 | Medium | 5.5 | 2026-03-04 | Dell Device Management Agent (DDMA), versions prior to 26.02, contain an Incorrect Authorization vulnerability. A low privileged attacker with local access cou… |
CVE-2026-3103 | Medium | 5.4 | 2026-03-04 | A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause… |
CVE-2025-13734 | Medium | 5.4 | 2026-03-03 | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissi… |
CVE-2026-3136 | Critical | 9.8 | 2026-03-03 | An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrar… |
CVE-2026-28354 | Medium | 6.5 | 2026-02-27 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing… |
CVE-2026-2293 | Critical | 9.8 | 2026-02-27 | A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are ena… |
CVE-2025-9572 | Medium | 5.0 | 2026-02-27 | n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which corr… |
CVE-2026-27653 | Medium | 6.7 | 2026-02-27 | The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow arbitrary code to be… |
CVE-2026-28227 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories v… |
CVE-2026-27153 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export… |
CVE-2026-25741 | High | 7.1 | 2026-02-26 | Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpoint for creating a card update session… |
CVE-2026-26973 | Medium | 4.3 | 2026-02-26 | Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `Review… |
CVE-2026-26265 | High | 7.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint all… |
CVE-2026-25963 | Medium | 6.5 | 2026-02-26 | Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could a… |
CVE-2026-27899 | High | 8.8 | 2026-02-26 | WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user c… |
CVE-2026-24487 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulner… |
CVE-2026-27607 | High | 8.1 | 2026-02-25 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in p… |
CVE-2026-25127 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly v… |
CVE-2026-1768 | Medium | 4.3 | 2026-02-24 | A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devoluti… |
CVE-2026-23984 | Medium | 6.5 | 2026-02-24 | An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification… |
CVE-2026-23982 | Medium | 6.5 | 2026-02-24 | An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Su… |
CVE-2026-27112 | Critical | 9.9 | 2026-02-20 | Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of bot… |
CVE-2026-2819 | Medium | 6.3 | 2026-02-20 | A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/de… |
CVE-2026-26963 | Medium | 6.1 | 2026-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.5 will incorrectly permit traffic from… |
CVE-2026-26328 | Medium | 6.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender ident… |
CVE-2026-26316 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based… |