CWE-863 · Incorrect Authorization (page 15)
Page 15 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3446 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated us… |
CVE-2025-43565 | High | 8.4 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution i… |
CVE-2025-43564 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system re… |
CVE-2025-43561 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution… |
CVE-2025-4646 | High | 7.2 | 2025-05-13 | Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before… |
CVE-2025-27696 | High | 8.8 | 2025-05-13 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissio… |
CVE-2025-31227 | Medium | 4.6 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to… |
CVE-2025-30440 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to bypas… |
CVE-2025-46744 | Low | 2.7 | 2025-05-12 | An authenticated administrator could modify the Created By username for a user account |
CVE-2025-29827 | Critical | 9.9 | 2025-05-08 | Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26842 | High | 7.5 | 2025-05-08 | An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with ac… |
CVE-2025-46265 | High | 8.8 | 2025-05-07 | On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS… |
CVE-2025-36546 | High | 8.1 | 2025-05-07 | On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; acce… |
CVE-2025-3476 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This i… | |
CVE-2025-3272 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password with… | |
CVE-2025-3609 | Medium | 5.3 | 2025-05-06 | The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales… |
CVE-2025-3879 | Medium | 6.6 | 2025-05-02 | Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypas… |
CVE-2025-46569 | | 2025-05-01 | Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for readin… | |
CVE-2025-23244 | High | 7.8 | 2025-05-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this v… |
CVE-2025-32971 | Low | 3.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-… |
CVE-2025-40619 | High | 7.5 | 2025-04-29 | Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentic… |
CVE-2025-3963 | High | 7.3 | 2025-04-27 | A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-3960 | High | 7.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3647 | Medium | 4.3 | 2025-04-25 | A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. |
CVE-2025-3645 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. |
CVE-2025-3644 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. |
CVE-2025-3861 | Medium | 5.4 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured… |
CVE-2025-46544 | Medium | 6.4 | 2025-04-25 | In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. |
CVE-2025-41423 | Low | 3.1 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/… |
CVE-2024-10306 | Medium | 5.4 | 2025-04-23 | A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does n… |
CVE-2025-43922 | High | 8.1 | 2025-04-21 | The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM. |
CVE-2024-12862 | | 2025-04-21 | Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove exte… | |
CVE-2025-32408 | Low | 2.5 | 2025-04-21 | In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled. |
CVE-2025-3838 | | 2025-04-21 | An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer inter… | |
CVE-2025-43921 | Medium | 5.3 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third par… |
CVE-2025-43917 | High | 8.2 | 2025-04-19 | In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an ad… |
CVE-2025-32796 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disab… |
CVE-2024-49808 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper author… |
CVE-2025-3453 | Medium | 5.3 | 2025-04-17 | The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin f… |
CVE-2025-2564 | Medium | 4.3 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Con… |
CVE-2025-27571 | Medium | 4.3 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching… |
CVE-2025-24839 | Low | 3.1 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows… |
CVE-2025-30703 | Low | 2.7 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-21582 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12… |
CVE-2025-2424 | Low | 3.1 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the… |
CVE-2025-32093 | Medium | 4.7 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, whic… |
CVE-2025-32068 | Medium | 5.4 | 2025-04-11 | Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth… |
CVE-2025-24866 | Low | 2.7 | 2025-04-10 | Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administrat… |
CVE-2025-26330 | High | 7.0 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access coul… |
CVE-2025-3475 | Medium | 6.5 | 2025-04-09 | Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This… |
CVE-2025-27188 | Medium | 4.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could re… |
CVE-2025-31331 | Medium | 4.3 | 2025-04-08 | SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation… |
CVE-2025-31481 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an… |
CVE-2024-38392 | Critical | 9.1 | 2025-04-02 | Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application… |
CVE-2025-27427 | Medium | 4.3 | 2025-04-01 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the… |
CVE-2025-30469 | Low | 2.4 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4. A person with physical access to an iOS device may… |
CVE-2025-24233 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicio… |
CVE-2025-24221 | High | 7.5 | 2025-03-31 | This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, visionOS 2.4. Sensitive keychai… |
CVE-2025-31673 | Medium | 4.6 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 bef… |
CVE-2025-30209 | Medium | 5.3 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information vi… |
CVE-2025-30155 | Medium | 4.3 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in… |
CVE-2025-30093 | High | 8.1 | 2025-03-27 | HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization… |
CVE-2025-2242 | High | 7.5 | 2025-03-27 | An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 all… |
CVE-2024-55965 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically… |
CVE-2025-30741 | Medium | 4.3 | 2025-03-25 | Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse… |
CVE-2025-30163 | Low | 3.4 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorre… |
CVE-2025-30162 | Low | 3.2 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services a… |
CVE-2025-29927 | Critical | 9.1 | 2025-03-21 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it… |
CVE-2025-30179 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to by… |
CVE-2025-27933 | Medium | 5.4 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with per… |
CVE-2025-27715 | Low | 3.3 | 2025-03-21 | Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private… |
CVE-2025-25274 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated us… |
CVE-2025-24920 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels… |
CVE-2024-44305 | High | 7.8 | 2025-03-21 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.6. An app may be able to gain root privileges. |
CVE-2025-26853 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. |
CVE-2024-9159 | Medium | 6.5 | 2025-03-20 | An incorrect authorization vulnerability exists in gaizhenbiao/chuanhuchatgpt version git c91dbfc. The vulnerability allows any user to restart the server at w… |
CVE-2024-9098 | Medium | 6.1 | 2025-03-20 | In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby ga… |
CVE-2024-10275 | High | 7.3 | 2025-03-20 | In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permi… |
CVE-2024-10273 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endp… |
CVE-2024-10109 | High | 8.3 | 2025-03-20 | A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/syste… |
CVE-2025-29924 | High | 7.5 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through… |
CVE-2025-1472 | Medium | 4.3 | 2025-03-19 | Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No… |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2025-27512 | | 2025-03-17 | Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatom… | |
CVE-2025-2202 | | 2025-03-17 | Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sen… | |
CVE-2025-2201 | | 2025-03-17 | Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information… | |
CVE-2025-30074 | High | 7.8 | 2025-03-16 | Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine. |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-29997 | | 2025-03-13 | This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker co… | |
CVE-2025-0652 | Medium | 4.3 | 2025-03-13 | An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versio… |
CVE-2024-7296 | Low | 2.7 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user wit… |
CVE-2025-27602 | Medium | 4.9 | 2025-03-11 | Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via mani… |
CVE-2025-27601 | Medium | 4.3 | 2025-03-11 | Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package pri… |
CVE-2024-55592 | Low | 3.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 a… |
CVE-2024-45328 | High | 7.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI comman… |
CVE-2025-27822 | High | 7.5 | 2025-03-07 | An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module… |
CVE-2025-2045 | Medium | 4.3 | 2025-03-06 | Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited perm… |
CVE-2025-1540 | Low | 3.1 | 2025-03-06 | An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, a… |
CVE-2025-2003 | High | 7.1 | 2025-03-05 | Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission. |
CVE-2025-27645 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by Trusting HTTP Permi… |