CWE-863 · Incorrect Authorization (page 22)
Page 22 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27715 | Low | 3.3 | 2025-03-21 | Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private… |
CVE-2025-25274 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated us… |
CVE-2025-24920 | Medium | 4.3 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels… |
CVE-2024-44305 | High | 7.8 | 2025-03-21 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.6. An app may be able to gain root privileges. |
CVE-2025-26853 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. |
CVE-2024-9159 | Medium | 6.5 | 2025-03-20 | An incorrect authorization vulnerability exists in gaizhenbiao/chuanhuchatgpt version git c91dbfc. The vulnerability allows any user to restart the server at w… |
CVE-2024-9098 | Medium | 6.1 | 2025-03-20 | In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby ga… |
CVE-2024-10275 | High | 7.3 | 2025-03-20 | In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permi… |
CVE-2024-10273 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endp… |
CVE-2024-10109 | High | 8.3 | 2025-03-20 | A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/syste… |
CVE-2025-29924 | High | 7.5 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through… |
CVE-2025-1472 | Medium | 4.3 | 2025-03-19 | Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No… |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2025-27512 | | 2025-03-17 | Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatom… | |
CVE-2025-2202 | | 2025-03-17 | Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sen… | |
CVE-2025-2201 | | 2025-03-17 | Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information… | |
CVE-2025-30074 | High | 7.8 | 2025-03-16 | Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine. |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-29997 | | 2025-03-13 | This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker co… | |
CVE-2025-0652 | Medium | 4.3 | 2025-03-13 | An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versio… |
CVE-2024-7296 | Low | 2.7 | 2025-03-13 | An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user wit… |
CVE-2025-27602 | Medium | 4.9 | 2025-03-11 | Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via mani… |
CVE-2025-27601 | Medium | 4.3 | 2025-03-11 | Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package pri… |
CVE-2024-55592 | Low | 3.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 a… |
CVE-2024-45328 | High | 7.8 | 2025-03-11 | An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI comman… |
CVE-2025-27822 | High | 7.5 | 2025-03-07 | An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module… |
CVE-2025-2045 | Medium | 4.3 | 2025-03-06 | Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited perm… |
CVE-2025-1540 | Low | 3.1 | 2025-03-06 | An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, a… |
CVE-2025-2003 | High | 7.1 | 2025-03-05 | Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission. |
CVE-2025-27645 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by Trusting HTTP Permi… |
CVE-2025-0360 | High | 7.8 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could l… |
CVE-2025-0359 | High | 8.5 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicati… |
CVE-2024-2321 | Medium | 5.6 | 2025-02-27 | An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the… |
CVE-2025-26532 | Low | 3.1 | 2025-02-24 | Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. |
CVE-2025-26531 | Low | 3.1 | 2025-02-24 | Insufficient capability checks made it possible to disable badges a user does not have permission to access. |
CVE-2025-26526 | Medium | 6.5 | 2025-02-24 | Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. |
CVE-2025-24526 | Medium | 4.3 | 2025-02-24 | Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channe… |
CVE-2024-5705 | High | 8.8 | 2025-02-19 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This… |
CVE-2025-27089 | Medium | 5.4 | 2025-02-19 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` ac… |
CVE-2024-45081 | Medium | 6.5 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect a… |
CVE-2024-39328 | Medium | 6.8 | 2025-02-18 | Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their configuration privileges in a multi-par… |
CVE-2024-57969 | Medium | 4.3 | 2025-02-14 | app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. |
CVE-2025-26511 | High | 8.8 | 2025-02-13 | Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0… |
CVE-2025-0937 | High | 7.1 | 2025-02-12 | Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. |
CVE-2025-1214 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the componen… |
CVE-2025-0516 | Medium | 4.3 | 2025-02-12 | Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform u… |
CVE-2024-54916 | Medium | 6.8 | 2025-02-11 | An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by… |
CVE-2025-24437 | Medium | 5.4 | 2025-02-11 | Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24436 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24434 | Critical | 9.1 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24421 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24420 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24419 | Medium | 4.3 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24409 | High | 8.2 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could… |
CVE-2025-24407 | High | 7.1 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could r… |
CVE-2025-24872 | Medium | 4.3 | 2025-02-11 | The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on b… |
CVE-2025-24869 | Medium | 4.3 | 2025-02-11 | SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their… |
CVE-2025-24200 | Medium | 6.1 | 2025-02-10 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 1… |
CVE-2021-41528 | | 2025-02-07 | An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be exp… | |
CVE-2025-23419 | Medium | 4.3 | 2025-02-05 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentic… |
CVE-2025-24860 | Medium | 5.4 | 2025-02-04 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using Cassand… |
CVE-2024-57434 | High | 8.8 | 2025-01-31 | macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator. |
CVE-2024-23929 | High | 7.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authenticat… |
CVE-2025-24500 | | 2025-01-30 | The vulnerability allows an unauthenticated attacker to access information in PAM database. | |
CVE-2025-24099 | Medium | 5.1 | 2025-01-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be abl… |
CVE-2024-57438 | Medium | 5.4 | 2025-01-29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles. |
CVE-2024-41140 | High | 8.1 | 2025-01-29 | Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. |
CVE-2025-24479 | | 2025-01-28 | A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access… | |
CVE-2025-23054 | Medium | 6.5 | 2025-01-28 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perfo… |
CVE-2025-23053 | Medium | 6.5 | 2025-01-28 | A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow… |
CVE-2025-0781 | High | 8.6 | 2025-01-28 | An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system le… |
CVE-2025-24141 | Low | 3.3 | 2025-01-27 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3. An attacker with physical access to an u… |
CVE-2025-24121 | Low | 3.3 | 2025-01-27 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to m… |
CVE-2025-24114 | Medium | 5.5 | 2025-01-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app ma… |
CVE-2024-54530 | Critical | 9.1 | 2025-01-27 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, visionOS 2.2, watchOS 11.2. Password autofil… |
CVE-2024-54512 | Critical | 9.1 | 2025-01-27 | The issue was addressed by removing the relevant flags. This issue is fixed in iOS 18.2 and iPadOS 18.2, watchOS 11.2. A system binary could be used to fingerp… |
CVE-2024-54488 | Medium | 5.3 | 2025-01-27 | A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7… |
CVE-2024-44172 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.3, macOS Ventura… |
CVE-2024-22316 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perform unauthorized actions to another user… |
CVE-2023-50946 | Medium | 6.5 | 2025-01-26 | IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization me… |
CVE-2025-24401 | Medium | 6.8 | 2025-01-22 | Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potent… |
CVE-2025-24400 | Medium | 4.3 | 2025-01-22 | Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers a… |
CVE-2025-24397 | Medium | 4.3 | 2025-01-22 | An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure p… |
CVE-2024-42013 | Medium | 6.4 | 2025-01-22 | In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows administrative or debu… |
CVE-2025-21570 | Medium | 6.1 | 2025-01-21 | Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login). The supported version that is affec… |
CVE-2025-21569 | Medium | 6.6 | 2025-01-21 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). The supported version that is affecte… |
CVE-2025-21568 | Medium | 4.5 | 2025-01-21 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supported version that is… |
CVE-2025-21567 | Medium | 4.3 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 9.1.0 and prior… |
CVE-2025-21565 | High | 7.5 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily… |
CVE-2025-21563 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported vers… |
CVE-2025-21562 | Medium | 4.3 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported vers… |
CVE-2025-21561 | Medium | 5.4 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2… |
CVE-2025-21560 | Medium | 6.5 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit). The supported version that is affec… |
CVE-2025-21558 | Medium | 5.4 | 2025-01-21 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported ve… |
CVE-2025-21557 | Medium | 5.4 | 2025-01-21 | Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Easily exploitable vulnerability al… |
CVE-2025-21556 | Critical | 9.9 | 2025-01-21 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affecte… |
CVE-2025-21555 | Medium | 5.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21554 | Medium | 5.3 | 2025-01-21 | Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported version… |
CVE-2025-21553 | Medium | 4.2 | 2025-01-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.25, 21.3-21.16 and 23.4-23.6. Difficult to… |
CVE-2025-21546 | Low | 3.8 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior… |