CWE-863 · Incorrect Authorization (page 11)
Page 11 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26205 | | 2026-02-19 | opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is… | |
CVE-2026-26336 | High | 7.5 | 2026-02-19 | Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, th… |
CVE-2026-25232 | High | 8.8 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator… |
CVE-2025-4960 | High | 7.8 | 2026-02-19 | The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple fl… |
CVE-2026-1999 | Medium | 6.5 | 2026-02-18 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository… |
CVE-2026-2386 | Medium | 4.3 | 2026-02-18 | The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Autho… |
CVE-2026-2126 | Medium | 5.3 | 2026-02-18 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to… |
CVE-2026-0997 | Medium | 4.3 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user… |
CVE-2026-22892 | Medium | 4.3 | 2026-02-13 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, w… |
CVE-2026-25767 | High | 8.1 | 2026-02-12 | LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing… |
CVE-2026-21722 | Medium | 5.3 | 2026-02-12 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read… |
CVE-2026-20624 | Medium | 5.5 | 2026-02-11 | An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be ab… |
CVE-2026-26031 | Medium | 5.3 | 2026-02-11 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe… |
CVE-2026-26012 | Medium | 6.5 | 2026-02-11 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can re… |
CVE-2026-25924 | High | 8.4 | 2026-02-11 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authentic… |
CVE-2026-25890 | High | 8.1 | 2026-02-09 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.5… |
CVE-2026-25875 | Critical | 9.8 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled J… |
CVE-2026-25811 | Critical | 9.1 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from t… |
CVE-2026-2141 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gat… |
CVE-2026-2208 | Medium | 4.3 | 2026-02-08 | A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules… |
CVE-2026-25859 | High | 8.8 | 2026-02-07 | Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in u… |
CVE-2026-25568 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforce… |
CVE-2026-25566 | Medium | 5.4 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate a… |
CVE-2026-25565 | Medium | 6.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring w… |
CVE-2026-25561 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as… |
CVE-2026-25729 | Medium | 6.5 | 2026-02-06 | DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability in the /api/v1/user… |
CVE-2026-23989 | High | 8.2 | 2026-02-06 | REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a mali… |
CVE-2026-24851 | High | 8.8 | 2026-02-06 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( op… |
CVE-2026-23632 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissio… |
CVE-2025-15342 | Medium | 4.3 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Reputation. |
CVE-2025-15321 | Low | 2.7 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Tanium Appliance. |
CVE-2026-23572 | High | 7.2 | 2026-02-05 | Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional… |
CVE-2026-1897 | Medium | 4.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the compon… |
CVE-2026-1553 | Medium | 4.8 | 2026-02-04 | Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4. |
CVE-2025-70997 | Medium | 6.5 | 2026-02-04 | A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level. |
CVE-2025-67856 | Medium | 5.4 | 2026-02-03 | A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be gra… |
CVE-2025-15395 | Medium | 4.3 | 2026-02-02 | IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or acc… |
CVE-2026-1734 | Medium | 5.3 | 2026-02-02 | A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabCon… |
CVE-2025-15525 | Medium | 5.3 | 2026-01-31 | The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization o… |
CVE-2026-22624 | Medium | 4.3 | 2026-01-30 | Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization. |
CVE-2025-15322 | Medium | 4.3 | 2026-01-30 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
CVE-2026-25040 | High | 8.8 | 2026-01-29 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who nor… |
CVE-2025-15288 | Low | 3.1 | 2026-01-29 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2026-22806 | Critical | 9.1 | 2026-01-29 | vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and… |
CVE-2026-24780 | High | 8.8 | 2026-01-29 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2026-24742 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive inform… |
CVE-2025-69289 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a n… |
CVE-2025-69218 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin… |
CVE-2025-68933 | Medium | 6.9 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_chan… |
CVE-2025-68666 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with mode… |
CVE-2025-13985 | Medium | 5.3 | 2026-01-28 | Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. |
CVE-2025-68660 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass… |
CVE-2020-36969 | High | 8.8 | 2026-01-28 | M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Att… |
CVE-2026-1514 | Medium | 6.5 | 2026-01-28 | Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify… |
CVE-2026-24748 | High | 7.2 | 2026-01-27 | Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the `… |
CVE-2026-24740 | Critical | 9.9 | 2026-01-27 | Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by labe… |
CVE-2020-36948 | Critical | 9.8 | 2026-01-27 | VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can e… |
CVE-2026-21721 | High | 8.1 | 2026-01-27 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permi… |
CVE-2026-24480 | | 2026-01-27 | QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks"… | |
CVE-2026-24003 | Medium | 4.3 | 2026-01-26 | EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authent… |
CVE-2026-24428 | High | 8.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privi… |
CVE-2025-66719 | Critical | 9.1 | 2026-01-23 | An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/proces… |
CVE-2025-14866 | High | 8.8 | 2026-01-23 | The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigure… |
CVE-2025-13928 | High | 7.5 | 2026-01-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allow… |
CVE-2026-23964 | Medium | 6.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in… |
CVE-2026-23961 | Medium | 5.3 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactio… |
CVE-2026-22822 | High | 8.8 | 2026-01-21 | External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.20.2… |
CVE-2025-68140 | Medium | 4.3 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the… |
CVE-2026-23837 | Critical | 9.8 | 2026-01-19 | MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows una… |
CVE-2026-1007 | High | 7.6 | 2026-01-19 | Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: fr… |
CVE-2026-20960 | High | 8.0 | 2026-01-16 | Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network. |
CVE-2025-43904 | Medium | 4.2 | 2026-01-16 | In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator. |
CVE-2026-23496 | Medium | 5.4 | 2026-01-15 | Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side… |
CVE-2026-22909 | High | 7.5 | 2026-01-15 | Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupt… |
CVE-2025-66005 | | 2026-01-14 | Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Denial-of-Service, information leak or even… | |
CVE-2025-15513 | Medium | 5.3 | 2026-01-14 | The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() f… |
CVE-2026-21274 | High | 7.8 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-0684 | Medium | 4.3 | 2026-01-13 | The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error i… |
CVE-2025-59020 | Medium | 6.5 | 2026-01-13 | By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability t… |
CVE-2026-22784 | Medium | 4.3 | 2026-01-12 | Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that… |
CVE-2025-41078 | High | 8.1 | 2026-01-12 | Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, us… |
CVE-2026-0831 | Medium | 5.3 | 2026-01-10 | The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validati… |
CVE-2025-14943 | Medium | 4.3 | 2026-01-10 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2026-22595 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token… |
CVE-2025-62487 | Low | 3.5 | 2026-01-09 | On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels… |
CVE-2025-13753 | Medium | 4.3 | 2026-01-09 | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization chec… |
CVE-2025-66315 | Medium | 4.3 | 2026-01-09 | There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settings, an attacker can… |
CVE-2026-22253 | Medium | 5.4 | 2026-01-08 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any au… |
CVE-2026-22230 | High | 7.6 | 2026-01-08 | OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disab… |
CVE-2026-21896 | Medium | 5.7 | 2026-01-08 | Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerabil… |
CVE-2026-22042 | High | 8.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAc… |
CVE-2025-14352 | Medium | 5.3 | 2026-01-07 | The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect authorization in the room-single.php shortco… |
CVE-2020-36920 | High | 8.8 | 2026-01-06 | iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console… |
CVE-2025-64421 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-61781 | High | 7.1 | 2026-01-05 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePop… |
CVE-2025-69417 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via… |
CVE-2025-69416 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… |
CVE-2025-69414 | High | 8.5 | 2026-01-02 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. |
CVE-2025-15406 | Medium | 6.3 | 2026-01-01 | A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Rem… |
CVE-2025-34467 | Medium | 4.3 | 2025-12-31 | ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined… |