CWE-863 · Incorrect Authorization (page 15)
Page 15 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39331 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorizati… |
CVE-2026-22682 | High | 7.1 | 2026-04-07 | OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permissi… |
CVE-2026-35604 | High | 8.1 | 2026-04-07 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when… |
CVE-2026-35586 | Medium | 6.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value(… |
CVE-2026-35491 | Medium | 6.1 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI p… |
CVE-2026-35490 | Critical | 9.8 | 2026-04-07 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to)… |
CVE-2026-5384 | Medium | 5.8 | 2026-04-07 | An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an instan… |
CVE-2026-5383 | Medium | 4.4 | 2026-04-07 | An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorr… |
CVE-2026-5382 | Low | 3.0 | 2026-04-07 | An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: In… |
CVE-2026-5381 | Low | 2.2 | 2026-04-07 | An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authoriza… |
CVE-2026-5380 | Medium | 5.3 | 2026-04-07 | An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance… |
CVE-2026-5379 | Low | 3.0 | 2026-04-07 | An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance o… |
CVE-2026-5378 | Medium | 5.8 | 2026-04-07 | An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-86… |
CVE-2026-5374 | Medium | 5.8 | 2026-04-07 | An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an in… |
CVE-2026-35464 | High | 7.5 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from m… |
CVE-2026-28808 | Critical | 9.8 | 2026-04-07 | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via s… |
CVE-2026-35442 | High | 8.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the co… |
CVE-2026-35412 | High | 7.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows… |
CVE-2026-34972 | Medium | 5.0 | 2026-04-06 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under sp… |
CVE-2026-35029 | High | 8.8 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role… |
CVE-2026-5574 | Medium | 6.5 | 2026-04-05 | A security vulnerability has been detected in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Affected is the function deletefile of the component FsBrowseClean… |
CVE-2026-34953 | Critical | 9.1 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, whi… |
CVE-2026-27447 | Medium | 4.8 | 2026-04-03 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains… |
CVE-2025-68153 | Medium | 6.5 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2025-68152 | Medium | 4.9 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2026-33105 | Critical | 10.0 | 2026-04-03 | Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32213 | Critical | 10.0 | 2026-04-03 | Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32173 | High | 8.6 | 2026-04-03 | Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network. |
CVE-2026-34376 | High | 7.5 | 2026-04-01 | PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulne… |
CVE-2025-71278 | High | 8.8 | 2026-04-01 | XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo… |
CVE-2026-34453 | High | 7.5 | 2026-03-31 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to un… |
CVE-2026-34586 | Medium | 6.5 | 2026-03-31 | PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, check_shared_access_all… |
CVE-2026-32726 | High | 8.1 | 2026-03-31 | SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypa… |
CVE-2026-34532 | Critical | 9.1 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacke… |
CVE-2026-33579 | Critical | 9.9 | 2026-03-31 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core app… |
CVE-2026-33578 | Medium | 4.3 | 2026-03-31 | OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies s… |
CVE-2026-33577 | High | 8.1 | 2026-03-31 | OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to appr… |
CVE-2026-33576 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network… |
CVE-2026-34506 | Medium | 4.3 | 2026-03-31 | OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended aut… |
CVE-2026-24029 | Medium | 6.5 | 2026-03-31 | When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is… |
CVE-2026-0562 | High | 8.3 | 2026-03-29 | A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other… |
CVE-2026-32978 | High | 8.0 | 2026-03-29 | OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners… |
CVE-2026-32972 | High | 7.1 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-o… |
CVE-2026-32924 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversat… |
CVE-2026-32923 | Medium | 5.4 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allow… |
CVE-2026-32919 | Medium | 6.1 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with… |
CVE-2026-32918 | High | 8.4 | 2026-03-29 | OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or siblin… |
CVE-2026-32915 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against… |
CVE-2026-32914 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-o… |
CVE-2026-33884 | Medium | 4.3 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to… |
CVE-2026-33869 | Medium | 4.8 | 2026-03-27 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4… |
CVE-2026-34364 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint, which serves the category listing API… |
CVE-2026-30689 | Medium | 4.3 | 2026-03-27 | In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure. Unauthorized parties can… |
CVE-2026-33726 | Medium | 5.4 | 2026-03-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Polic… |
CVE-2026-4933 | High | 7.5 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0… |
CVE-2026-3573 | High | 7.5 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0… |
CVE-2026-3526 | Medium | 5.3 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0… |
CVE-2026-3525 | Medium | 5.3 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0… |
CVE-2026-33477 | Medium | 4.3 | 2026-03-26 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endp… |
CVE-2026-3115 | Medium | 4.3 | 2026-03-26 | Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs… |
CVE-2026-33470 | Medium | 6.5 | 2026-03-26 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted… |
CVE-2026-33469 | Medium | 6.5 | 2026-03-26 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, an authenticated non-admin user can retrieve… |
CVE-2026-33015 | Medium | 5.2 | 2026-03-26 | EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return… |
CVE-2026-33014 | Medium | 5.2 | 2026-03-26 | EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores `authorized` back… |
CVE-2026-29044 | Medium | 5.0 | 2026-03-26 | EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler… |
CVE-2026-33343 | Unrated | | 2026-03-26 | etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restri… |
CVE-2026-4274 | Medium | 5.4 | 2026-03-26 | Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership syn… |
CVE-2026-4263 | | 2026-03-26 | Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 'visitor' in '/… | |
CVE-2026-4262 | | 2026-03-26 | Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 'ID' in '/api/v1… | |
CVE-2026-33249 | Medium | 4.3 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2… |
CVE-2026-33217 | High | 7.1 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on messag… |
CVE-2026-33722 | Medium | 5.3 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets cou… |
CVE-2026-33720 | Medium | 4.2 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to version 2.8.0, when the `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK` environment variable is set to `true`, t… |
CVE-2026-2726 | Medium | 4.3 | 2026-03-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have al… |
CVE-2026-3210 | Medium | 5.3 | 2026-03-25 | Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4. |
CVE-2026-4363 | Low | 3.7 | 2026-03-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain con… |
CVE-2026-28864 | Low | 3.3 | 2026-03-25 | This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7… |
CVE-2026-33330 | High | 7.1 | 2026-03-24 | FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows… |
CVE-2026-33326 | Medium | 4.3 | 2026-03-24 | Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing… |
CVE-2026-33527 | Medium | 4.3 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authent… |
CVE-2026-33421 | Medium | 6.5 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Serv… |
CVE-2026-33676 | Medium | 6.5 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` fi… |
CVE-2026-33668 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locke… |
CVE-2026-33316 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regai… |
CVE-2026-28755 | Medium | 5.4 | 2026-03-24 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured… |
CVE-2026-32642 | Medium | 4.3 | 2026-03-24 | Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to c… |
CVE-2026-4639 | High | 8.8 | 2026-03-24 | Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain admini… |
CVE-2026-27646 | Medium | 6.1 | 2026-03-23 | OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize ho… |
CVE-2026-27183 | Medium | 5.3 | 2026-03-23 | OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip… |
CVE-2026-33650 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to pe… |
CVE-2026-32899 | Medium | 4.3 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-ev… |
CVE-2026-32895 | Medium | 5.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to… |
CVE-2026-32067 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that a… |
CVE-2026-32058 | Low | 2.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously… |
CVE-2026-32051 | High | 8.8 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner… |
CVE-2026-32050 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enque… |
CVE-2026-32042 | High | 8.8 | 2026-03-21 | OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requ… |
CVE-2026-33428 | Medium | 6.5 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership c… |
CVE-2026-33424 | Medium | 5.9 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an attacker can grant access to a private message… |
CVE-2026-33291 | Medium | 5.4 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators can create Zendesk tickets for topics… |