CWE-863 · Incorrect Authorization (page 2)
Page 2 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45808 | | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who… | |
CVE-2026-71381 | Medium | 4.0 | 2026-08-07 | Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker c… |
CVE-2026-66000 | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's c… | |
CVE-2026-17594 | | 2026-08-07 | Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. A… | |
CVE-2026-66059 | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue… | |
CVE-2026-37171 | Medium | 5.9 | 2026-08-07 | A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and en… |
CVE-2026-7867 | High | 7.8 | 2026-08-06 | A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org… |
CVE-2026-71433 | Medium | 5.3 | 2026-08-06 | LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-… |
CVE-2026-71325 | | 2026-08-06 | Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernet… | |
CVE-2026-48076 | Medium | 6.5 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and p… |
CVE-2026-48074 | Low | 2.7 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes… |
CVE-2026-47185 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated use… | |
CVE-2026-45414 | High | 8.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organiza… |
CVE-2025-15674 | Low | 2.7 | 2026-08-06 | The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected con… |
CVE-2026-64640 | Medium | 6.5 | 2026-08-06 | Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to regi… |
CVE-2026-19010 | High | 7.3 | 2026-08-06 | A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component M… |
CVE-2026-19006 | Medium | 6.3 | 2026-08-06 | A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exe… |
CVE-2026-18997 | Medium | 6.3 | 2026-08-06 | A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts o… |
CVE-2026-18992 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of… |
CVE-2026-52466 | Critical | 9.8 | 2026-08-06 | Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuF… |
CVE-2026-71315 | High | 8.2 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded look… |
CVE-2026-18954 | Medium | 5.5 | 2026-08-05 | Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perf… |
CVE-2026-50749 | Medium | 6.5 | 2026-08-05 | Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending e… |
CVE-2026-71247 | Medium | 6.5 | 2026-08-05 | Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging t… |
CVE-2026-71234 | High | 7.5 | 2026-08-05 | Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a q… |
CVE-2026-71201 | Medium | 5.0 | 2026-08-05 | In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another… |
CVE-2026-71192 | | 2026-08-05 | In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests… | |
CVE-2026-71191 | | 2026-08-05 | In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests… | |
CVE-2026-55707 | | 2026-08-05 | In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets fr… | |
CVE-2026-70494 | High | 8.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in back… |
CVE-2026-70490 | Medium | 6.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_web… |
CVE-2026-70488 | Medium | 4.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write acces… |
CVE-2026-70484 | Medium | 4.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trust… |
CVE-2026-70474 | | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoin… | |
CVE-2026-70472 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accep… | |
CVE-2026-70471 | | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise injects $vars into the code executi… | |
CVE-2026-69262 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, `DELETE /api/v1/chatflows/:id` authorized requests wit… | |
CVE-2026-64630 | | 2026-08-04 | A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link. | |
CVE-2026-18773 | Medium | 6.3 | 2026-08-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py… |
CVE-2026-62927 | High | 7.5 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, a… |
CVE-2026-48333 | Critical | 9.8 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this… |
CVE-2026-48113 | | 2026-08-03 | Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restriction… | |
CVE-2026-68980 | Critical | 9.1 | 2026-08-03 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authoriz… |
CVE-2026-62354 | Medium | 4.3 | 2026-08-03 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parame… |
CVE-2026-58139 | Medium | 6.5 | 2026-08-03 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract pla… |
CVE-2026-68930 | Medium | 6.5 | 2026-08-03 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opene… |
CVE-2026-15254 | Medium | 6.5 | 2026-08-03 | The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and… |
CVE-2026-68581 | High | 8.1 | 2026-08-02 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric… |
CVE-2026-18572 | Medium | 6.5 | 2026-08-02 | Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access du… |
CVE-2026-16540 | High | 7.5 | 2026-08-02 | The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allo… |
CVE-2026-16064 | Medium | 5.4 | 2026-08-02 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing… |
CVE-2026-15939 | Low | 2.7 | 2026-08-02 | The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, r… |
CVE-2026-67341 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database a… |
CVE-2026-67310 | Medium | 5.4 | 2026-08-01 | OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResou… |
CVE-2026-2411 | Medium | 6.5 | 2026-08-01 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PE… |
CVE-2026-18394 | High | 7.4 | 2026-07-31 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_RE… |
CVE-2026-54707 | Medium | 5.4 | 2026-07-31 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6… |
CVE-2026-18203 | Medium | 6.5 | 2026-07-31 | A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions… |
CVE-2026-14929 | Medium | 4.3 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber… |
CVE-2026-62323 | Medium | 6.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token… |
CVE-2026-55502 | High | 7.1 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though Get… |
CVE-2026-55499 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the ow… |
CVE-2026-14538 | High | 7.7 | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1… |
CVE-2026-14537 | Critical | 9.8 | 2026-07-31 | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to… |
CVE-2026-10031 | Medium | 4.2 | 2026-07-30 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbol… |
CVE-2026-67528 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global nume… |
CVE-2026-65835 | Medium | 6.6 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItem… |
CVE-2026-67347 | Medium | 6.8 | 2026-07-30 | Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts u… |
CVE-2026-41187 | Medium | 6.5 | 2026-07-30 | Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNet… |
CVE-2026-14923 | Medium | 6.5 | 2026-07-30 | The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates pos… |
CVE-2026-48449 | Critical | 10.0 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-67439 | Medium | 4.3 | 2026-07-29 | OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait… |
CVE-2026-65975 | Medium | 6.5 | 2026-07-29 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0… |
CVE-2026-6336 | Medium | 5.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2025-14562 | Low | 3.1 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-18236 | | 2026-07-29 | A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject event… | |
CVE-2026-54693 | | 2026-07-29 | ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone… | |
CVE-2026-18255 | High | 7.2 | 2026-07-29 | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allo… |
CVE-2026-44944 | | 2026-07-29 | An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscs… | |
CVE-2026-58159 | High | 8.2 | 2026-07-29 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 thr… |
CVE-2025-10656 | Critical | 9.8 | 2026-07-29 | The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and… |
CVE-2026-58156 | Medium | 4.9 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-66064 | Medium | 5.3 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using… |
CVE-2026-54719 | High | 7.5 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file=… |
CVE-2026-48396 | High | 8.6 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker co… |
CVE-2026-48390 | High | 8.2 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain… |
CVE-2026-7868 | Medium | 6.5 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privile… |
CVE-2026-14167 | High | 8.8 | 2026-07-28 | A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incor… |
CVE-2026-43672 | High | 7.1 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A mali… |
CVE-2026-42016 | High | 8.1 | 2026-07-27 | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issue… |
CVE-2026-17568 | High | 8.8 | 2026-07-27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group… |
CVE-2026-17530 | Medium | 6.3 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr… |
CVE-2026-17529 | Medium | 6.3 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati… |
CVE-2026-59689 | High | 8.0 | 2026-07-27 | An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an aut… |
CVE-2026-17039 | Low | 3.1 | 2026-07-24 | A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path… |
CVE-2026-8789 | High | 8.1 | 2026-07-24 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification… |
CVE-2026-15704 | Critical | 9.8 | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent tr… |
CVE-2026-15630 | Critical | 9.9 | 2026-07-23 | A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch… |
CVE-2026-59678 | | 2026-07-23 | An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network confi… | |
CVE-2026-13068 | Medium | 4.2 | 2026-07-22 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, di… |