CWE-863 · Incorrect Authorization (page 20)
Page 20 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27213 | Medium | 4.9 | 2025-08-21 | An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and mak… |
CVE-2025-57728 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files |
CVE-2025-9228 | Medium | 4.3 | 2025-08-20 | MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes w… |
CVE-2025-55213 | Critical | 9.8 | 2025-08-18 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( ope… |
CVE-2025-55205 | Critical | 9.0 | 2025-08-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authentic… |
CVE-2025-36120 | High | 8.8 | 2025-08-18 | IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization c… |
CVE-2025-7773 | | 2025-08-14 | A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlate… | |
CVE-2024-10219 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain cond… |
CVE-2025-49556 | High | 7.5 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2024-41979 | High | 7.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-42951 | High | 8.8 | 2025-08-12 | Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the correspondi… |
CVE-2025-8807 | Medium | 6.3 | 2025-08-10 | A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-a… |
CVE-2025-8796 | Medium | 5.4 | 2025-08-10 | A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/dele… |
CVE-2025-54888 | | 2025-08-09 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636… | |
CVE-2025-55077 | High | 7.4 | 2025-08-07 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Micros… |
CVE-2025-8533 | | 2025-08-07 | A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAc… | |
CVE-2025-20332 | Medium | 4.3 | 2025-08-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an aff… |
CVE-2025-54253 | Critical | 10.0 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacke… |
CVE-2025-54554 | Medium | 5.3 | 2025-08-04 | tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries… |
CVE-2025-20701 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privile… |
CVE-2025-8435 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functiona… |
CVE-2025-8434 | High | 7.3 | 2025-08-01 | A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.p… |
CVE-2025-8068 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability chec… |
CVE-2025-54583 | Medium | 6.5 | 2025-07-30 | GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote… |
CVE-2025-43251 | Medium | 5.5 | 2025-07-30 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.6. A local attacker may gain access to Keychain it… |
CVE-2025-43230 | Medium | 4.0 | 2025-07-30 | The issue was addressed with additional permissions checks. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visi… |
CVE-2025-43197 | Medium | 4.0 | 2025-07-30 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may b… |
CVE-2025-53902 | Medium | 4.3 | 2025-07-29 | Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99… |
CVE-2025-54533 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration |
CVE-2025-54532 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies |
CVE-2025-54569 | Medium | 4.5 | 2025-07-28 | In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escalation. |
CVE-2025-54596 | Medium | 4.3 | 2025-07-25 | Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts. |
CVE-2025-0765 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed… |
CVE-2025-6018 | High | 7.8 | 2025-07-23 | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unp… |
CVE-2025-29757 | | 2025-07-19 | An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer… | |
CVE-2025-53943 | | 2025-07-16 | VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerability in the command handler where permis… | |
CVE-2025-6981 | Medium | 4.3 | 2025-07-15 | An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors… |
CVE-2025-50086 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.42, 8.4… |
CVE-2025-50085 | Medium | 5.5 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9… |
CVE-2025-50084 | Medium | 4.9 | 2025-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 a… |
CVE-2025-30751 | High | 8.8 | 2025-07-15 | Vulnerability in the Oracle Database component of Oracle Database Server. Supported versions that are affected are 19.27 and 23.4-23.8. Easily exploitable v… |
CVE-2025-30750 | Low | 2.4 | 2025-07-15 | Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 and 23.4-23.8. Easily… |
CVE-2025-30748 | Medium | 6.1 | 2025-07-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-30747 | Medium | 4.3 | 2025-07-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2025-30744 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Multiplatform Sync Errors). Supported versions that are affect… |
CVE-2025-30743 | High | 8.1 | 2025-07-15 | Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). The supported version that is a… |
CVE-2025-30739 | Medium | 5.5 | 2025-07-15 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12… |
CVE-2025-53895 | High | 8.8 | 2025-07-15 | ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability i… |
CVE-2025-53836 | Critical | 9.9 | 2025-07-15 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-5199 | High | 7.3 | 2025-07-12 | In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying fi… |
CVE-2025-6549 | Medium | 6.5 | 2025-07-11 | An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reac… |
CVE-2025-6168 | Low | 2.7 | 2025-07-10 | An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintaine… |
CVE-2025-4972 | Low | 2.7 | 2025-07-10 | An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users wit… |
CVE-2025-3396 | Medium | 4.3 | 2025-07-10 | An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed a… |
CVE-2025-49536 | High | 7.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypas… |
CVE-2025-21450 | Critical | 9.1 | 2025-07-08 | Cryptographic issue occurs due to use of insecure connection method while downloading. |
CVE-2025-20999 | Medium | 4.1 | 2025-07-08 | Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi… |
CVE-2025-20300 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low… |
CVE-2025-26850 | Critical | 9.3 | 2025-07-05 | The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems. |
CVE-2025-0885 | | 2025-07-03 | Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could… | |
CVE-2025-32462 | Low | 2.8 | 2025-06-30 | Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on… |
CVE-2025-47871 | Medium | 4.3 | 2025-06-30 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when… |
CVE-2025-46702 | Medium | 5.4 | 2025-06-30 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-53391 | Critical | 9.3 | 2025-06-28 | The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active sett… |
CVE-2025-6702 | Medium | 4.3 | 2025-06-26 | A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The… |
CVE-2025-6707 | Medium | 4.2 | 2025-06-26 | Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This… |
CVE-2025-5822 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers t… |
CVE-2025-49550 | Medium | 4.3 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-49549 | Low | 2.7 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-52890 | High | 8.1 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables ru… |
CVE-2025-48466 | High | 8.1 | 2025-06-24 | Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentia… |
CVE-2024-3511 | Medium | 4.3 | 2025-06-23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to fla… |
CVE-2025-52918 | Medium | 5.0 | 2025-06-21 | Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. |
CVE-2025-52487 | High | 7.5 | 2025-06-21 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM… |
CVE-2025-3228 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from play… |
CVE-2025-3227 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-5071 | High | 8.8 | 2025-06-19 | The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs… |
CVE-2025-49825 | Critical | 9.8 | 2025-06-17 | Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulner… |
CVE-2025-3880 | Medium | 4.3 | 2025-06-17 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability… |
CVE-2025-49586 | High | 8.8 | 2025-06-13 | XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki)… |
CVE-2025-6003 | Medium | 5.3 | 2025-06-12 | The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versi… |
CVE-2025-48446 | High | 8.8 | 2025-06-11 | Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0… |
CVE-2025-48445 | High | 8.8 | 2025-06-11 | Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from… |
CVE-2025-4128 | Low | 3.1 | 2025-06-11 | Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions an… |
CVE-2024-8270 | Medium | 5.5 | 2025-06-11 | The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploit… |
CVE-2024-7457 | High | 7.8 | 2025-06-11 | The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's… |
CVE-2025-36578 | Medium | 6.8 | 2025-06-10 | Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could pot… |
CVE-2025-40568 | Medium | 4.3 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-40567 | Medium | 6.5 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-40670 | High | 8.8 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by… |
CVE-2025-40669 | Medium | 6.5 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the appl… |
CVE-2025-40668 | Medium | 6.5 | 2025-06-09 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other user… |
CVE-2025-49599 | Medium | 4.1 | 2025-06-06 | Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account t… |
CVE-2025-48935 | Critical | 9.1 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission re… |
CVE-2025-48888 | Medium | 5.3 | 2025-06-04 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.41.3 and prior to versions 2.1.13, 2.2.13, and 2.3.2, `deno run --allow-read -… |
CVE-2025-21479 | High | 8.6 | 2025-06-03 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
CVE-2025-21480 | High | 8.6 | 2025-06-03 | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. |
CVE-2025-3260 | High | 8.3 | 2025-06-02 | A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerabilit… |
CVE-2025-20674 | Critical | 9.8 | 2025-06-02 | In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with… |
CVE-2025-48948 | Medium | 6.5 | 2025-05-30 | Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated… |