CWE-863 · Incorrect Authorization (page 12)
Page 12 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15390 | Medium | 6.3 | 2025-12-31 | A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in… |
CVE-2025-14987 | | 2025-12-30 | When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecuti… | |
CVE-2025-14986 | | 2025-12-30 | When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutio… | |
CVE-2025-15126 | Low | 3.1 | 2025-12-28 | A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositi… |
CVE-2025-15125 | Low | 3.1 | 2025-12-28 | A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission… |
CVE-2025-15124 | Low | 3.1 | 2025-12-28 | A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation… |
CVE-2025-15123 | Low | 3.1 | 2025-12-28 | A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulatio… |
CVE-2025-15122 | Low | 3.1 | 2025-12-28 | A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing mani… |
CVE-2025-15120 | Low | 3.1 | 2025-12-28 | A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of t… |
CVE-2025-15119 | Low | 3.1 | 2025-12-28 | A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of t… |
CVE-2025-68941 | Medium | 4.9 | 2025-12-26 | Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. |
CVE-2025-68940 | Low | 3.1 | 2025-12-26 | In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. |
CVE-2025-68938 | Medium | 4.3 | 2025-12-26 | Gitea before 1.25.2 mishandles authorization for deletion of releases. |
CVE-2025-15085 | Medium | 4.3 | 2025-12-25 | A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/… |
CVE-2025-66378 | Medium | 5.9 | 2025-12-25 | Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing… |
CVE-2025-59683 | High | 8.2 | 2025-12-25 | Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchang… |
CVE-2019-25237 | Critical | 9.8 | 2025-12-24 | V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the use… |
CVE-2018-25146 | High | 8.1 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attac… |
CVE-2025-2515 | High | 7.2 | 2025-12-24 | A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (q… |
CVE-2025-64641 | Medium | 4.1 | 2025-12-24 | Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly… |
CVE-2025-13767 | Medium | 4.3 | 2025-12-24 | Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Matterm… |
CVE-2025-68476 | | 2025-12-22 | KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in… | |
CVE-2025-58052 | High | 8.1 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group man… |
CVE-2025-53922 | Medium | 4.9 | 2025-12-19 | Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in… |
CVE-2025-68422 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restric… |
CVE-2025-68386 | Medium | 4.3 | 2025-12-18 | Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type t… |
CVE-2025-14318 | Medium | 4.3 | 2025-12-18 | Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download… |
CVE-2025-47382 | High | 7.8 | 2025-12-18 | Memory corruption while loading an invalid firmware in boot loader. |
CVE-2025-68129 | Medium | 6.8 | 2025-12-17 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is… |
CVE-2025-14081 | Medium | 4.3 | 2025-12-17 | The Ultimate Member plugin for WordPress is vulnerable to Profile Privacy Setting Bypass in all versions up to, and including, 2.11.0. This is due to a flaw in… |
CVE-2025-13324 | Low | 3.7 | 2025-12-17 | Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1)… |
CVE-2025-14305 | High | 7.8 | 2025-12-17 | ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replace ListCheck.exe with a malicious execut… |
CVE-2025-67740 | Low | 2.7 | 2025-12-11 | In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata |
CVE-2025-67490 | Medium | 5.4 | 2025-12-10 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultan… |
CVE-2025-13184 | Critical | 9.8 | 2025-12-10 | Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.636… |
CVE-2025-9056 | Medium | 5.3 | 2025-12-10 | Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. |
CVE-2025-54838 | Medium | 6.8 | 2025-12-09 | An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device v… |
CVE-2025-40819 | Medium | 4.3 | 2025-12-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restricti… |
CVE-2025-8148 | Medium | 4.2 | 2025-12-05 | An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH… |
CVE-2025-66623 | High | 7.4 | 2025-12-05 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some… |
CVE-2025-66581 | Medium | 6.5 | 2025-12-05 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization… |
CVE-2025-65900 | Medium | 6.5 | 2025-12-04 | Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation… |
CVE-2025-14016 | Medium | 5.4 | 2025-12-04 | A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such m… |
CVE-2025-66406 | Medium | 5.0 | 2025-12-03 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check f… |
CVE-2025-20381 | Medium | 5.4 | 2025-12-03 | In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allo… |
CVE-2024-32643 | High | 7.5 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ dec… |
CVE-2025-12756 | Medium | 4.3 | 2025-12-01 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boa… |
CVE-2025-13653 | Medium | 4.3 | 2025-12-01 | In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use speci… |
CVE-2025-13829 | | 2025-12-01 | Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Cri… | |
CVE-2025-13813 | Medium | 5.6 | 2025-12-01 | A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage… |
CVE-2025-13806 | High | 7.3 | 2025-12-01 | A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-si… |
CVE-2025-66433 | Medium | 4.2 | 2025-11-30 | HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24… |
CVE-2025-66424 | Medium | 6.5 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66423 | High | 7.1 | 2025-11-30 | Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. |
CVE-2025-66360 | High | 8.8 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) informatio… |
CVE-2025-12971 | Medium | 4.3 | 2025-11-27 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2024-5539 | | 2025-11-27 | The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended a… | |
CVE-2025-55469 | Critical | 9.8 | 2025-11-26 | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. |
CVE-2025-9803 | High | 8.8 | 2025-11-25 | lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to v… |
CVE-2025-13432 | Medium | 4.3 | 2025-11-21 | Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the altera… |
CVE-2025-62189 | Medium | 4.3 | 2025-11-21 | LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If exploited, a non-administrative user may create a new user account… |
CVE-2025-62730 | High | 8.8 | 2025-11-20 | SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However… |
CVE-2025-13468 | Medium | 5.4 | 2025-11-20 | A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete… |
CVE-2025-59111 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to dele… |
CVE-2025-41346 | Critical | 9.8 | 2025-11-18 | Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numeric… |
CVE-2025-65073 | High | 7.5 | 2025-11-17 | OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorizatio… |
CVE-2025-7736 | Low | 3.1 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-11865 | Medium | 4.3 | 2025-11-15 | An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circum… |
CVE-2025-12149 | | 2025-11-14 | In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signal… | |
CVE-2025-41436 | Low | 3.1 | 2025-11-14 | Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel co… |
CVE-2025-11776 | Medium | 4.3 | 2025-11-14 | Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `… |
CVE-2025-64753 | Medium | 5.3 | 2025-11-13 | grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing has… |
CVE-2025-64746 | Medium | 4.6 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level perm… |
CVE-2025-11777 | Low | 3.1 | 2025-11-13 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows user… |
CVE-2025-64707 | Medium | 5.4 | 2025-11-12 | Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a rol… |
CVE-2025-13063 | High | 7.3 | 2025-11-12 | A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack m… |
CVE-2025-65002 | High | 7.5 | 2025-11-12 | Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters. |
CVE-2025-61830 | High | 7.1 | 2025-11-11 | Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass securit… |
CVE-2025-11862 | | 2025-11-11 | A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API. | |
CVE-2025-49145 | High | 8.7 | 2025-11-10 | Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly adminis… |
CVE-2025-12925 | High | 7.3 | 2025-11-10 | A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic… |
CVE-2025-12924 | Medium | 4.3 | 2025-11-10 | A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/mai… |
CVE-2025-12621 | Medium | 5.3 | 2025-11-08 | The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-64490 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-37736 | High | 8.8 | 2025-11-07 | Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed… |
CVE-2025-63687 | Medium | 6.5 | 2025-11-07 | An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/Auth… |
CVE-2025-43459 | Medium | 4.6 | 2025-11-04 | An authentication issue was addressed with improved state management. This issue is fixed in watchOS 26.1. An attacker with physical access to a locked Apple W… |
CVE-2025-43397 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app m… |
CVE-2025-43387 | High | 7.8 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. A malicious app may be able to g… |
CVE-2025-43336 | Medium | 4.4 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app with… |
CVE-2025-12038 | Medium | 4.3 | 2025-11-01 | The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config… |
CVE-2025-62275 | Medium | 5.3 | 2025-11-01 | Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7… |
CVE-2025-34273 | Medium | 6.5 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards… |
CVE-2023-7322 | High | 8.1 | 2025-10-30 | Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless abl… |
CVE-2025-62795 | High | 7.1 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged auth… |
CVE-2025-12082 | High | 7.5 | 2025-10-30 | Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 befor… |
CVE-2025-62259 | Medium | 5.4 | 2025-10-27 | Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through u… |
CVE-2025-11971 | Medium | 6.5 | 2025-10-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed… |
CVE-2025-11888 | Low | 2.7 | 2025-10-25 | The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data du… |
CVE-2025-59048 | High | 8.1 | 2025-10-23 | OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Imp… |