CWE-863 · Incorrect Authorization (page 13)
Page 13 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62394 | Medium | 4.3 | 2025-10-23 | Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related message… |
CVE-2025-62651 | Medium | 6.5 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface. |
CVE-2025-62648 | Medium | 6.4 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume. |
CVE-2025-62647 | Medium | 5.0 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API t… |
CVE-2025-48044 | | 2025-10-17 | Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/polic… | |
CVE-2025-6892 | | 2025-10-17 | An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allo… | |
CVE-2025-62506 | High | 8.1 | 2025-10-16 | MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service a… |
CVE-2025-9955 | Medium | 5.7 | 2025-10-16 | An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin servic… |
CVE-2025-10611 | Critical | 9.8 | 2025-10-16 | Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed… |
CVE-2025-10545 | Low | 3.1 | 2025-10-16 | Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users… |
CVE-2025-54267 | Medium | 6.5 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-54265 | Medium | 5.9 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-54263 | High | 8.1 | 2025-10-14 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-42939 | Medium | 4.3 | 2025-10-14 | SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of… |
CVE-2025-62243 | Medium | 5.4 | 2025-10-13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2… |
CVE-2025-11581 | Medium | 5.3 | 2025-10-10 | A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAP… |
CVE-2025-11580 | Medium | 5.3 | 2025-10-10 | A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization… |
CVE-2025-48043 | | 2025-10-10 | Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/autho… | |
CVE-2025-8886 | Medium | 6.7 | 2025-10-10 | Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorizati… |
CVE-2025-7374 | Medium | 5.4 | 2025-10-10 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due… |
CVE-2025-11340 | High | 7.7 | 2025-10-09 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authe… |
CVE-2025-11439 | Medium | 4.3 | 2025-10-08 | A vulnerability was found in JhumanJ OpnForm up to 1.9.3. This issue affects some unknown processing of the file /show/integrations. Performing manipulation re… |
CVE-2025-11438 | Medium | 6.3 | 2025-10-08 | A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /custom-domains of the component API Endpoin… |
CVE-2025-44824 | High | 8.5 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/a… |
CVE-2025-3719 | High | 8.1 | 2025-10-07 | An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited… |
CVE-2025-59451 | Low | 3.5 | 2025-10-06 | The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. |
CVE-2025-59449 | Medium | 4.9 | 2025-10-06 | The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to… |
CVE-2025-10696 | Medium | 5.4 | 2025-10-03 | OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the own… |
CVE-2025-49641 | Medium | 4.3 | 2025-10-03 | A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve… |
CVE-2025-27236 | Medium | 6.5 | 2025-10-03 | A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining… |
CVE-2025-11239 | Medium | 4.3 | 2025-10-02 | Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hu… |
CVE-2024-58260 | High | 7.6 | 2025-10-02 | A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with upda… |
CVE-2025-41246 | High | 7.6 | 2025-09-29 | VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administra… |
CVE-2025-11060 | Medium | 5.7 | 2025-09-26 | A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized recor… |
CVE-2025-59824 | Medium | 5.4 | 2025-09-24 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni an… |
CVE-2025-43806 | Medium | 4.3 | 2025-09-22 | Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92… |
CVE-2025-59420 | High | 7.5 | 2025-09-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unkno… |
CVE-2025-59714 | Medium | 6.5 | 2025-09-19 | In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. |
CVE-2025-10016 | | 2025-09-16 | The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request install… | |
CVE-2025-10015 | | 2025-09-16 | The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged atta… | |
CVE-2025-43307 | Medium | 4.0 | 2025-09-15 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive us… |
CVE-2025-31254 | Medium | 5.4 | 2025-09-15 | This issue was addressed with improved URL validation. This issue is fixed in Safari 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may l… |
CVE-2025-59376 | Low | 3.7 | 2025-09-15 | feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows… |
CVE-2025-43789 | Medium | 5.3 | 2025-09-12 | JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are regist… |
CVE-2025-43784 | Medium | 6.5 | 2025-09-10 | Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and… |
CVE-2025-58134 | Medium | 4.3 | 2025-09-09 | Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access. |
CVE-2025-54246 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass… |
CVE-2025-48042 | | 2025-09-07 | Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This vulnerability is associa… | |
CVE-2025-48523 | High | 7.8 | 2025-09-04 | In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to loca… |
CVE-2025-32333 | High | 7.8 | 2025-09-04 | In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lead to local escala… |
CVE-2025-26442 | Medium | 5.5 | 2025-09-04 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due to a logic error in… |
CVE-2025-26436 | High | 7.8 | 2025-09-04 | In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypa… |
CVE-2025-23262 | Medium | 6.3 | 2025-09-04 | NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the con… |
CVE-2025-23256 | High | 8.7 | 2025-09-04 | NVIDIA BlueField contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorization to modify the co… |
CVE-2025-22428 | High | 7.8 | 2025-09-02 | In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-7974 | High | 7.5 | 2025-09-02 | rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affec… |
CVE-2025-41031 | | 2025-09-02 | Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST reques… | |
CVE-2025-41030 | | 2025-09-02 | Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TIn… | |
CVE-2025-3586 | High | 7.2 | 2025-09-01 | In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 upda… |
CVE-2025-55177 | Medium | 5.4 | 2025-08-29 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp… |
CVE-2025-54877 | Medium | 5.3 | 2025-08-29 | Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2025-25010 | Medium | 6.5 | 2025-08-28 | Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana… |
CVE-2025-9376 | Medium | 6.5 | 2025-08-28 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an… |
CVE-2025-5187 | Medium | 6.7 | 2025-08-27 | A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patchi… |
CVE-2025-1501 | Medium | 4.3 | 2025-08-26 | An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restrictio… |
CVE-2025-36157 | Critical | 9.8 | 2025-08-24 | IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server… |
CVE-2025-53971 | Low | 3.8 | 2025-08-21 | Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to… |
CVE-2025-49810 | Low | 3.5 | 2025-08-21 | Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts |
CVE-2025-27213 | Medium | 4.9 | 2025-08-21 | An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and mak… |
CVE-2025-57728 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files |
CVE-2025-9228 | Medium | 4.3 | 2025-08-20 | MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes w… |
CVE-2025-55213 | Critical | 9.8 | 2025-08-18 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( ope… |
CVE-2025-55205 | Critical | 9.0 | 2025-08-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authentic… |
CVE-2025-36120 | High | 8.8 | 2025-08-18 | IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization c… |
CVE-2025-7773 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlate… | |
CVE-2024-10219 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2025-49556 | High | 7.5 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2024-41979 | High | 7.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-42951 | High | 8.8 | 2025-08-12 | Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the correspondi… |
CVE-2025-8807 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-a… |
CVE-2025-8796 | Medium | 5.4 | 2025-08-10 | A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/dele… |
CVE-2025-54888 | | 2025-08-09 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636… | |
CVE-2025-55077 | High | 7.4 | 2025-08-07 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Micros… |
CVE-2025-8533 | | 2025-08-07 | A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAc… | |
CVE-2025-20332 | Medium | 4.3 | 2025-08-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an aff… |
CVE-2025-54253 | Critical | 10.0 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacke… |
CVE-2025-54554 | Medium | 5.3 | 2025-08-04 | tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries… |
CVE-2025-20701 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privile… |
CVE-2025-8435 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-8434 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.p… |
CVE-2025-8068 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability chec… |
CVE-2025-54583 | Medium | 6.5 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote… |
CVE-2025-43251 | Medium | 5.5 | 2025-07-30 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.6. A local attacker may gain access to Keychain it… |
CVE-2025-43230 | Medium | 4.0 | 2025-07-30 | The issue was addressed with additional permissions checks. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visi… |
CVE-2025-43197 | Medium | 4.0 | 2025-07-30 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may b… |
CVE-2025-53902 | Medium | 4.3 | 2025-07-29 | Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99… |
CVE-2025-54533 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration |
CVE-2025-54532 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies |