CWE-863 · Incorrect Authorization (page 4)
Page 4 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14892 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
CVE-2026-87652 | Low | 3.1 | 2026-09-09 | Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web ori… |
CVE-2026-87651 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87644 | High | 8.3 | 2026-09-09 | Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and l… |
CVE-2026-87629 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive informatio… |
CVE-2026-87626 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via craf… |
CVE-2026-87614 | Low | 3.1 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass w… |
CVE-2026-87610 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged pag… |
CVE-2026-87598 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-87594 | Medium | 5.3 | 2026-09-09 | Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain se… |
CVE-2026-87591 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chro… |
CVE-2026-87589 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-87584 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page… |
CVE-2026-87580 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and levera… |
CVE-2026-87577 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a… |
CVE-2026-87575 | Medium | 5.4 | 2026-09-09 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-87570 | High | 8.8 | 2026-09-09 | Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leverag… |
CVE-2026-87561 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted Chrom… |
CVE-2026-87544 | Critical | 9.8 | 2026-09-09 | Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged… |
CVE-2026-87540 | Medium | 5.4 | 2026-09-09 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium s… |
CVE-2026-87519 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access… |
CVE-2026-87515 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access rest… |
CVE-2026-87509 | High | 8.1 | 2026-09-09 | Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox… |
CVE-2026-87508 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom… |
CVE-2026-87505 | High | 8.1 | 2026-09-09 | Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site… |
CVE-2026-87499 | High | 8.1 | 2026-09-09 | Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site is… |
CVE-2026-87492 | Critical | 9.6 | 2026-09-09 | Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-87485 | Low | 3.1 | 2026-09-09 | Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin… |
CVE-2026-87483 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a c… |
CVE-2026-87481 | High | 8.3 | 2026-09-09 | Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-87476 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (C… |
CVE-2026-87473 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access… |
CVE-2026-87471 | High | 8.1 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-87468 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromi… |
CVE-2026-87466 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-87465 | Medium | 4.2 | 2026-09-09 | Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI ele… |
CVE-2026-87463 | Medium | 4.8 | 2026-09-09 | Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via cra… |
CVE-2026-87452 | Low | 3.1 | 2026-09-09 | Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-87450 | High | 7.5 | 2026-09-09 | Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive info… |
CVE-2026-87447 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy… |
CVE-2026-87432 | Medium | 4.2 | 2026-09-09 | Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI el… |
CVE-2026-53638 | Medium | 4.3 | 2026-09-08 | Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vuln… |
CVE-2026-81997 | Medium | 6.3 | 2026-09-08 | Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-81996 | High | 8.8 | 2026-09-08 | Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this… |
CVE-2026-78626 | High | 8.1 | 2026-09-08 | The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an… |
CVE-2026-75990 | High | 8.6 | 2026-09-08 | Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attack… |
CVE-2026-19232 | Critical | 9.9 | 2026-09-08 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-77774 | High | 8.6 | 2026-09-08 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-77111 | High | 8.7 | 2026-09-08 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could l… |
CVE-2026-77109 | High | 8.6 | 2026-09-08 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability… |
CVE-2026-77108 | High | 7.5 | 2026-09-08 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability… |
CVE-2026-76202 | High | 8.2 | 2026-09-08 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability… |
CVE-2026-28666 | High | 8.8 | 2026-09-08 | In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could… |
CVE-2026-28663 | High | 7.8 | 2026-09-08 | In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead t… |
CVE-2026-28620 | High | 7.8 | 2026-09-08 | In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additi… |
CVE-2026-70283 | High | 7.0 | 2026-09-08 | Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-86073 | High | 7.6 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to th… |
CVE-2026-82074 | Medium | 6.5 | 2026-09-08 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specia… |
CVE-2026-82073 | Medium | 6.5 | 2026-09-08 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization check… |
CVE-2026-82062 | Medium | 5.5 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by… |
CVE-2026-82053 | High | 8.1 | 2026-09-08 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authent… |
CVE-2026-86665 | High | 7.3 | 2026-09-08 | A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The man… |
CVE-2026-73318 | Low | 3.8 | 2026-09-08 | XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit f… |
CVE-2026-73317 | Low | 2.7 | 2026-09-08 | XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebui… |
CVE-2026-73313 | Medium | 6.8 | 2026-09-08 | XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete… |
CVE-2026-73310 | Medium | 5.9 | 2026-09-08 | XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redi… |
CVE-2026-33391 | Medium | 5.4 | 2026-09-08 | An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authentic… |
CVE-2026-33388 | High | 7.4 | 2026-09-08 | An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticat… |
CVE-2026-86544 | High | 8.1 | 2026-09-07 | knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Att… |
CVE-2026-86437 | High | 7.2 | 2026-09-07 | Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin a… |
CVE-2026-86498 | High | 7.7 | 2026-09-07 | In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission |
CVE-2026-86493 | Medium | 6.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards |
CVE-2026-86490 | Medium | 6.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint |
CVE-2026-86487 | Low | 3.1 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content |
CVE-2026-76560 | High | 7.5 | 2026-09-07 | A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stor… |
CVE-2026-84173 | | 2026-09-07 | In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path… | |
CVE-2026-86274 | Medium | 5.3 | 2026-09-07 | A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar… |
CVE-2026-86271 | Medium | 4.7 | 2026-09-07 | A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionMa… |
CVE-2026-86193 | | 2026-09-05 | grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-a… | |
CVE-2026-53769 | Medium | 6.5 | 2026-09-04 | Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks s… |
CVE-2026-16941 | Medium | 4.3 | 2026-09-04 | IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization. |
CVE-2026-19283 | High | 7.7 | 2026-09-04 | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitiv… |
CVE-2026-85697 | Medium | 6.5 | 2026-09-04 | Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low p… |
CVE-2026-85622 | Medium | 5.3 | 2026-09-04 | AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowin… |
CVE-2026-85620 | High | 8.6 | 2026-09-04 | Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. At… |
CVE-2026-85619 | High | 7.5 | 2026-09-04 | AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and… |
CVE-2026-85597 | Critical | 9.1 | 2026-09-04 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass clien… |
CVE-2026-85592 | Low | 3.7 | 2026-09-04 | phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants acces… |
CVE-2026-85587 | | 2026-09-04 | phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attac… | |
CVE-2026-85512 | High | 7.3 | 2026-09-04 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session… |
CVE-2026-4644 | | 2026-09-04 | A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an… | |
CVE-2026-85538 | | 2026-09-04 | An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required perm_modify or perm_… | |
CVE-2025-15691 | Medium | 5.3 | 2026-09-04 | The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submiss… |
CVE-2026-82302 | High | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-82299 | Medium | 6.5 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
CVE-2026-82298 | Medium | 4.3 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
CVE-2026-78583 | High | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarati… |
CVE-2026-82023 | Medium | 4.3 | 2026-09-03 | LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor rol… |
CVE-2026-80515 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its ch… | |
CVE-2026-85166 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e… |