CWE-863 · Incorrect Authorization (page 2)
Page 2 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95811 | Medium | 6.5 | 2026-09-25 | Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path… |
CVE-2026-87720 | | 2026-09-24 | Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code… | |
CVE-2026-84399 | High | 8.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently as… |
CVE-2026-61788 | High | 7.4 | 2026-09-24 | DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql… |
CVE-2026-94609 | High | 8.8 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group members… |
CVE-2026-91161 | Medium | 6.4 | 2026-09-24 | OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and t… |
CVE-2026-88916 | Medium | 6.8 | 2026-09-24 | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026. |
CVE-2026-88907 | High | 7.4 | 2026-09-24 | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026. |
CVE-2026-57590 | High | 8.1 | 2026-09-24 | A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authentica… |
CVE-2026-92874 | Medium | 5.4 | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain co… |
CVE-2026-92529 | Medium | 4.3 | 2026-09-24 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain condi… |
CVE-2026-96680 | Medium | 4.3 | 2026-09-23 | A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.a… |
CVE-2026-96603 | High | 7.3 | 2026-09-23 | A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the compo… |
CVE-2026-82405 | | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a t… | |
CVE-2026-63131 | | 2026-09-23 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant b… | |
CVE-2026-55632 | Medium | 4.3 | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, en… |
CVE-2026-85724 | Critical | 9.6 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes cl… |
CVE-2026-88974 | Medium | 5.4 | 2026-09-23 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-… |
CVE-2026-96512 | High | 7.8 | 2026-09-23 | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indic… |
CVE-2026-90951 | Low | 3.7 | 2026-09-23 | The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing some… |
CVE-2026-84743 | Low | 3.8 | 2026-09-23 | The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a… |
CVE-2026-84742 | Low | 2.7 | 2026-09-23 | The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST AP… |
CVE-2026-84098 | Medium | 6.5 | 2026-09-23 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before d… |
CVE-2026-95814 | High | 8.1 | 2026-09-22 | Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed… |
CVE-2026-77425 | Medium | 4.3 | 2026-09-22 | Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/stra… |
CVE-2026-79767 | Medium | 5.5 | 2026-09-22 | Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverb… |
CVE-2026-75745 | Critical | 10.0 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2026-75728 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-75723 | Critical | 10.0 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-95654 | High | 7.4 | 2026-09-22 | Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validi… |
CVE-2026-75608 | High | 7.7 | 2026-09-22 | Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx… |
CVE-2026-6922 | High | 7.1 | 2026-09-22 | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. Thi… |
CVE-2026-59815 | Medium | 4.3 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllo… |
CVE-2026-62247 | Medium | 6.5 | 2026-09-21 | Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-… |
CVE-2026-91164 | Medium | 4.3 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::valida… |
CVE-2026-61744 | Medium | 6.5 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a… |
CVE-2026-77560 | High | 8.1 | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equi… |
CVE-2026-88978 | Medium | 4.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pk… |
CVE-2026-63342 | Medium | 6.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-r… |
CVE-2026-55563 | | 2026-09-21 | Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with t… | |
CVE-2026-80110 | High | 8.1 | 2026-09-21 | A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string c… |
CVE-2026-71543 | | 2026-09-21 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled i… | |
CVE-2026-55625 | Medium | 4.9 | 2026-09-21 | GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/i… |
CVE-2026-55060 | Low | 3.7 | 2026-09-21 | GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only autho… |
CVE-2026-52743 | Medium | 4.3 | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belong… |
CVE-2026-52742 | | 2026-09-21 | GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline… | |
CVE-2026-52740 | | 2026-09-21 | GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authoriza… | |
CVE-2026-93954 | Medium | 4.3 | 2026-09-19 | A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the fi… |
CVE-2026-1242 | Medium | 4.3 | 2026-09-19 | The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and includin… |
CVE-2026-92403 | Low | 3.7 | 2026-09-19 | The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to t… |
CVE-2026-11540 | Medium | 5.3 | 2026-09-18 | IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servl… |
CVE-2026-81178 | Low | 3.5 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide col… |
CVE-2026-61672 | High | 7.1 | 2026-09-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied m… |
CVE-2026-93594 | High | 8.1 | 2026-09-18 | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file… |
CVE-2026-93593 | High | 8.1 | 2026-09-18 | ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but… |
CVE-2026-75157 | High | 7.5 | 2026-09-18 | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could… |
CVE-2026-68791 | High | 8.6 | 2026-09-17 | Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. |
CVE-2026-93379 | Medium | 4.3 | 2026-09-17 | Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium se… |
CVE-2026-92992 | Medium | 6.3 | 2026-09-17 | A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai… |
CVE-2026-92904 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocat… |
CVE-2026-92893 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not en… |
CVE-2026-92611 | | 2026-09-17 | In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single… | |
CVE-2026-81439 | Low | 3.7 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote acce… |
CVE-2026-92894 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying… |
CVE-2026-78426 | Low | 3.7 | 2026-09-17 | The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but… |
CVE-2026-90923 | Medium | 6.5 | 2026-09-17 | The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete… |
CVE-2026-92801 | High | 8.8 | 2026-09-16 | cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatc… |
CVE-2026-92796 | High | 8.8 | 2026-09-16 | Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to exe… |
CVE-2026-92793 | High | 8.1 | 2026-09-16 | GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appen… |
CVE-2026-92788 | High | 8.8 | 2026-09-16 | Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can… |
CVE-2026-92782 | High | 8.1 | 2026-09-16 | Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from oth… |
CVE-2026-92776 | High | 8.1 | 2026-09-16 | Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with autho… |
CVE-2026-92774 | Medium | 4.3 | 2026-09-16 | Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attacke… |
CVE-2026-92771 | Medium | 6.5 | 2026-09-16 | Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permissio… |
CVE-2026-92764 | Medium | 4.3 | 2026-09-16 | OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's m… |
CVE-2026-92760 | Medium | 6.5 | 2026-09-16 | Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics… |
CVE-2026-76438 | Medium | 6.5 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low… |
CVE-2026-20072 | Medium | 4.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network u… |
CVE-2026-86043 | High | 7.5 | 2026-09-16 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversize… |
CVE-2026-92402 | Medium | 6.3 | 2026-09-16 | A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserCo… |
CVE-2026-61709 | Medium | 5.3 | 2026-09-16 | OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded w… |
CVE-2026-92130 | Low | 3.1 | 2026-09-16 | Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step… |
CVE-2026-73469 | Medium | 5.8 | 2026-09-16 | When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the int… |
CVE-2026-19640 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization… |
CVE-2026-27552 | High | 8.1 | 2026-09-16 | A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the devic… |
CVE-2026-79708 | High | 8.5 | 2026-09-16 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain cond… |
CVE-2026-73460 | Medium | 6.1 | 2026-09-16 | On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can c… |
CVE-2026-76863 | Medium | 4.3 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling within filter_conns_du… |
CVE-2026-91735 | High | 8.3 | 2026-09-15 | Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially exec… |
CVE-2026-91734 | High | 7.4 | 2026-09-15 | Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox vi… |
CVE-2026-87144 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-87141 | High | 7.7 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-87137 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-90971 | Medium | 6.5 | 2026-09-15 | Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user… |
CVE-2026-13210 | High | 7.7 | 2026-09-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-63443 | High | 8.3 | 2026-09-15 | Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() fol… |
CVE-2026-91983 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Atta… |
CVE-2026-65831 | High | 7.7 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.co… |
CVE-2026-59965 | High | 7.1 | 2026-09-15 | Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/g… |
CVE-2026-55774 | | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace… |