CWE-863 · Incorrect Authorization (page 11)
Page 11 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56778 | Medium | 6.4 | 2026-07-08 | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workf… |
CVE-2026-56776 | High | 7.4 | 2026-07-08 | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access us… |
CVE-2026-56775 | Medium | 5.4 | 2026-07-08 | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing a… |
CVE-2026-56220 | Medium | 6.5 | 2026-07-08 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manif… |
CVE-2026-56086 | High | 8.8 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-55428 | High | 8.2 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordi… |
CVE-2026-54698 | Medium | 5.9 | 2026-07-07 | Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field… |
CVE-2026-53935 | Medium | 6.9 | 2026-07-07 | Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to cre… |
CVE-2026-50529 | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-… | |
CVE-2026-55435 | Medium | 5.4 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.3… |
CVE-2026-12352 | Medium | 5.9 | 2026-07-07 | This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device. |
CVE-2026-34047 | Critical | 9.9 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap route… |
CVE-2026-53642 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enab… | |
CVE-2026-32718 | Medium | 6.5 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints… |
CVE-2026-54765 | High | 8.5 | 2026-07-06 | Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted… |
CVE-2026-42331 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorizat… | |
CVE-2026-14536 | High | 8.8 | 2026-07-06 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypas… |
CVE-2026-14716 | Medium | 6.3 | 2026-07-05 | A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/ga… |
CVE-2026-58424 | High | 8.9 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass |
CVE-2026-28744 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. |
CVE-2026-28740 | High | 7.1 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-uni… |
CVE-2026-28699 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. |
CVE-2026-27780 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-prot… |
CVE-2026-27775 | High | 8.8 | 2026-07-03 | Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant… |
CVE-2026-27761 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository com… |
CVE-2026-26231 | High | 8.5 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read bu… |
CVE-2026-46730 | Medium | 4.2 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-54998 | High | 8.8 | 2026-07-02 | Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. |
CVE-2026-8079 | High | 7.3 | 2026-07-02 | In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PD… |
CVE-2026-56842 | High | 7.5 | 2026-07-02 | A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Applica… |
CVE-2026-14340 | Medium | 5.0 | 2026-07-01 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to… |
CVE-2026-53492 | Critical | 9.6 | 2026-07-01 | containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interfac… |
CVE-2026-56152 | Medium | 5.3 | 2026-07-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC… |
CVE-2026-53905 | High | 7.1 | 2026-07-01 | MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated… |
CVE-2026-53902 | Medium | 6.5 | 2026-07-01 | MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can mo… |
CVE-2026-7663 | Critical | 9.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper… |
CVE-2026-48286 | Critical | 10.0 | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code… |
CVE-2026-57953 | Medium | 5.4 | 2026-06-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations b… |
CVE-2026-57951 | Medium | 6.5 | 2026-06-29 | Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operatio… |
CVE-2026-57950 | High | 8.1 | 2026-06-29 | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp… |
CVE-2026-13508 | Medium | 5.5 | 2026-06-28 | A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversat… |
CVE-2026-13484 | Medium | 5.0 | 2026-06-28 | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experimen… |
CVE-2026-58056 | High | 7.6 | 2026-06-28 | RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not… |
CVE-2026-53577 | Medium | 6.5 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executio… |
CVE-2026-55189 | High | 7.7 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe ha… |
CVE-2026-55188 | High | 8.2 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket repli… |
CVE-2026-52779 | Medium | 5.4 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Ca… |
CVE-2026-44735 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL wo… |
CVE-2026-9640 | High | 7.2 | 2026-06-26 | A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restrict… |
CVE-2026-54096 | High | 8.4 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST… |
CVE-2026-54091 | High | 7.5 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File… |
CVE-2026-55411 | Medium | 6.8 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the aut… |
CVE-2026-54573 | | 2026-06-25 | Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if… | |
CVE-2026-5952 | Medium | 4.3 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain… |
CVE-2026-5796 | Medium | 4.3 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain c… |
CVE-2026-11379 | Medium | 5.3 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorre… |
CVE-2026-0934 | Low | 3.8 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-52808 | High | 7.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:own… |
CVE-2026-52795 | Medium | 4.3 | 2026-06-24 | Gogs is an open source self-hosted Git service. In 0.14.3 and earlier, any authenticated user can watch a private repository they have no access to, because th… |
CVE-2026-56232 | High | 8.8 | 2026-06-24 | Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey functio… |
CVE-2026-48493 | Medium | 5.5 | 2026-06-23 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and… |
CVE-2026-54518 | Medium | 6.5 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, Unwrapp… |
CVE-2026-54517 | Medium | 5.3 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in Bean… |
CVE-2026-46549 | Low | 2.0 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the… |
CVE-2026-23513 | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowe… | |
CVE-2026-54761 | High | 7.1 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider… |
CVE-2026-54555 | High | 7.8 | 2026-06-23 | rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject… |
CVE-2026-54321 | High | 7.0 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0 until 0.184.0, sandbox previews that w… |
CVE-2026-54320 | High | 8.4 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be… |
CVE-2026-54324 | Medium | 6.5 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw… |
CVE-2026-54022 | Medium | 5.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the ydoc:document:join Socket.IO handler ch… |
CVE-2026-54021 | Medium | 6.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy… |
CVE-2026-49983 | Medium | 5.2 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env… |
CVE-2026-45692 | Medium | 5.4 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree… |
CVE-2026-54307 | Critical | 9.6 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could re… |
CVE-2026-56694 | Medium | 5.4 | 2026-06-23 | NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to vali… |
CVE-2026-27604 | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the A… | |
CVE-2026-56268 | High | 7.7 | 2026-06-22 | Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omi… |
CVE-2026-54281 | | 2026-06-22 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform… | |
CVE-2026-8823 | Low | 3.8 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administra… |
CVE-2026-41049 | High | 7.1 | 2026-06-22 | Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions… |
CVE-2026-41048 | High | 7.1 | 2026-06-22 | Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functions like "restore f… |
CVE-2026-8074 | Low | 3.8 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a Use… |
CVE-2026-56424 | High | 8.8 | 2026-06-22 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability che… |
CVE-2026-44911 | Medium | 6.3 | 2026-06-22 | Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed… |
CVE-2026-12797 | Medium | 6.3 | 2026-06-21 | A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banne… |
CVE-2026-50559 | High | 7.5 | 2026-06-19 | Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus… |
CVE-2026-48794 | | 2026-06-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… | |
CVE-2026-48772 | Critical | 10.0 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <ad… |
CVE-2026-48089 | | 2026-06-19 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any a… | |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-47339 | High | 8.1 | 2026-06-19 | Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themsel… |
CVE-2026-56075 | High | 8.8 | 2026-06-18 | PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administra… |
CVE-2026-56074 | Medium | 5.5 | 2026-06-18 | PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass app… |
CVE-2026-10741 | Medium | 4.9 | 2026-06-17 | Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repositor… |
CVE-2026-54803 | Critical | 9.8 | 2026-06-17 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. |
CVE-2026-48781 | Critical | 9.9 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio… |
CVE-2026-42357 | Medium | 6.5 | 2026-06-17 | Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This i… |
CVE-2026-41280 | Medium | 4.9 | 2026-06-17 | Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache… |
CVE-2026-32967 | Critical | 9.1 | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. U… |