CWE-863 · Incorrect Authorization (page 21)
Page 21 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3611 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allow… |
CVE-2025-1792 | Low | 3.1 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member inf… |
CVE-2024-7097 | Medium | 4.3 | 2025-05-30 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardles… |
CVE-2024-7096 | Medium | 4.2 | 2025-05-30 | A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new u… |
CVE-2025-48881 | High | 8.3 | 2025-05-30 | Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all ob… |
CVE-2025-48757 | Critical | 9.3 | 2025-05-30 | An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database… |
CVE-2025-48475 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an… |
CVE-2025-48474 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations… |
CVE-2025-48473 | Medium | 4.3 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, th… |
CVE-2025-48472 | High | 8.1 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications fo… |
CVE-2025-3913 | Medium | 5.3 | 2025-05-29 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy se… |
CVE-2025-25251 | High | 7.8 | 2025-05-28 | An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker… |
CVE-2025-25026 | Medium | 4.3 | 2025-05-28 | IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check. |
CVE-2025-4975 | | 2025-05-22 | When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power s… | |
CVE-2025-48373 | Critical | 9.1 | 2025-05-22 | Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels base… |
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2024-13947 | Medium | 6.0 | 2025-05-22 | Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enter… |
CVE-2025-30171 | Critical | 9.0 | 2025-05-22 | System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This is… |
CVE-2025-1110 | Low | 2.7 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could ac… |
CVE-2025-20257 | Medium | 6.5 | 2025-05-21 | A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated… |
CVE-2025-1418 | | 2025-05-21 | A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited fu… | |
CVE-2025-1417 | | 2025-05-21 | In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). Th… | |
CVE-2025-1416 | | 2025-05-21 | In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Manag… | |
CVE-2025-1415 | | 2025-05-21 | A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of… | |
CVE-2025-47937 | Low | 3.7 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4… |
CVE-2025-4101 | Medium | 4.3 | 2025-05-17 | The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capabil… |
CVE-2025-47930 | Medium | 5.3 | 2025-05-16 | Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanis… |
CVE-2025-46834 | | 2025-05-15 | Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249a… | |
CVE-2025-2570 | Low | 2.7 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which… |
CVE-2025-2527 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view… |
CVE-2025-3446 | Medium | 4.3 | 2025-05-15 | Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated us… |
CVE-2025-43565 | High | 8.4 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution i… |
CVE-2025-43564 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system re… |
CVE-2025-43561 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution… |
CVE-2025-4646 | High | 7.2 | 2025-05-13 | Incorrect Authorization vulnerability in Centreon web (API Token creation form modules) allows Privilege Escalation.This issue affects web: from 24.04.0 before… |
CVE-2025-27696 | High | 8.8 | 2025-05-13 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissio… |
CVE-2025-31227 | Medium | 4.6 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to… |
CVE-2025-30440 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to bypas… |
CVE-2025-46744 | Low | 2.7 | 2025-05-12 | An authenticated administrator could modify the Created By username for a user account |
CVE-2025-29827 | Critical | 9.9 | 2025-05-08 | Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26842 | High | 7.5 | 2025-05-08 | An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with ac… |
CVE-2025-46265 | High | 8.8 | 2025-05-07 | On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS… |
CVE-2025-36546 | High | 8.1 | 2025-05-07 | On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; acce… |
CVE-2025-3476 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This i… | |
CVE-2025-3272 | | 2025-05-07 | Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password with… | |
CVE-2025-3609 | Medium | 5.3 | 2025-05-06 | The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales… |
CVE-2025-3879 | Medium | 6.6 | 2025-05-02 | Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypas… |
CVE-2025-46569 | | 2025-05-01 | Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for readin… | |
CVE-2025-23244 | High | 7.8 | 2025-05-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this v… |
CVE-2025-32971 | Low | 3.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-… |
CVE-2025-40619 | High | 7.5 | 2025-04-29 | Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentic… |
CVE-2025-3963 | High | 7.3 | 2025-04-27 | A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown processing of the f… |
CVE-2025-3960 | High | 7.3 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3647 | Medium | 4.3 | 2025-04-25 | A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. |
CVE-2025-3645 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. |
CVE-2025-3644 | Medium | 4.3 | 2025-04-25 | A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. |
CVE-2025-3861 | Medium | 5.4 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured… |
CVE-2025-46544 | Medium | 6.4 | 2025-04-25 | In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. |
CVE-2025-41423 | Low | 3.1 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/… |
CVE-2024-10306 | Medium | 5.4 | 2025-04-23 | A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does n… |
CVE-2025-43922 | High | 8.1 | 2025-04-21 | The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM. |
CVE-2024-12862 | | 2025-04-21 | Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove exte… | |
CVE-2025-32408 | Low | 2.5 | 2025-04-21 | In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled. |
CVE-2025-3838 | | 2025-04-21 | An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer inter… | |
CVE-2025-43921 | Medium | 5.3 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third par… |
CVE-2025-43917 | High | 8.2 | 2025-04-19 | In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an ad… |
CVE-2025-32796 | Medium | 6.5 | 2025-04-18 | Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disab… |
CVE-2024-49808 | Medium | 6.3 | 2025-04-18 | IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper author… |
CVE-2025-3453 | Medium | 5.3 | 2025-04-17 | The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin f… |
CVE-2025-2564 | Medium | 4.3 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Con… |
CVE-2025-27571 | Medium | 4.3 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching… |
CVE-2025-24839 | Low | 3.1 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows… |
CVE-2025-30703 | Low | 2.7 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-21582 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12… |
CVE-2025-2424 | Low | 3.1 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the… |
CVE-2025-32093 | Medium | 4.7 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, whic… |
CVE-2025-32068 | Medium | 5.4 | 2025-04-11 | Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth… |
CVE-2025-24866 | Low | 2.7 | 2025-04-10 | Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administrat… |
CVE-2025-26330 | High | 7.0 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access coul… |
CVE-2025-3475 | Medium | 6.5 | 2025-04-09 | Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This… |
CVE-2025-27188 | Medium | 4.3 | 2025-04-08 | Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could re… |
CVE-2025-31331 | Medium | 4.3 | 2025-04-08 | SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation… |
CVE-2025-31481 | High | 7.5 | 2025-04-03 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an… |
CVE-2024-38392 | Critical | 9.1 | 2025-04-02 | Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application… |
CVE-2025-27427 | Medium | 4.3 | 2025-04-01 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the… |
CVE-2025-30469 | Low | 2.4 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4. A person with physical access to an iOS device may… |
CVE-2025-24233 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicio… |
CVE-2025-24221 | High | 7.5 | 2025-03-31 | This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, visionOS 2.4. Sensitive keychai… |
CVE-2025-31673 | Medium | 4.6 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 bef… |
CVE-2025-30209 | Medium | 5.3 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information vi… |
CVE-2025-30155 | Medium | 4.3 | 2025-03-31 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in… |
CVE-2025-30093 | High | 8.1 | 2025-03-27 | HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization… |
CVE-2025-2242 | High | 7.5 | 2025-03-27 | An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 all… |
CVE-2024-55965 | Medium | 6.5 | 2025-03-26 | An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically… |
CVE-2025-30741 | Medium | 4.3 | 2025-03-25 | Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse… |
CVE-2025-30163 | Low | 3.4 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorre… |
CVE-2025-30162 | Low | 3.2 | 2025-03-24 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services a… |
CVE-2025-29927 | Critical | 9.1 | 2025-03-21 | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it… |
CVE-2025-30179 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to by… |
CVE-2025-27933 | Medium | 5.4 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with per… |