CWE-863 · Incorrect Authorization (page 5)
Page 5 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85093 | Medium | 6.5 | 2026-09-03 | Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticat… |
CVE-2026-74769 | Medium | 6.5 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker… |
CVE-2026-77125 | High | 7.1 | 2026-09-02 | A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended… |
CVE-2026-77122 | Medium | 4.3 | 2026-09-02 | An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed a… |
CVE-2026-14199 | High | 7.1 | 2026-09-02 | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache… |
CVE-2026-82293 | Medium | 4.3 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Ac… |
CVE-2026-78609 | Medium | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An acto… |
CVE-2026-78598 | Medium | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Contro… |
CVE-2026-78587 | Low | 3.1 | 2026-09-02 | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does… |
CVE-2026-78153 | Medium | 5.3 | 2026-09-02 | The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection cover… |
CVE-2026-2688 | Medium | 6.5 | 2026-09-02 | The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server expl… |
CVE-2025-8945 | Medium | 5.3 | 2026-09-02 | The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API. |
CVE-2025-15490 | Medium | 5.3 | 2026-09-02 | The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via cra… |
CVE-2025-15489 | Medium | 5.3 | 2026-09-02 | The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password… |
CVE-2026-81165 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. |
CVE-2026-81158 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. |
CVE-2026-73478 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. |
CVE-2026-73477 | Medium | 5.3 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1. |
CVE-2026-73475 | Critical | 9.1 | 2026-09-02 | Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, fr… |
CVE-2026-84808 | Medium | 4.3 | 2026-09-02 | Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team ac… |
CVE-2026-84355 | Low | 3.1 | 2026-09-02 | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web… |
CVE-2026-84354 | Critical | 9.6 | 2026-09-02 | Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code… |
CVE-2026-84335 | High | 8.3 | 2026-09-02 | Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-84334 | High | 8.1 | 2026-09-02 | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sand… |
CVE-2026-84332 | Medium | 6.5 | 2026-09-02 | Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HT… |
CVE-2026-84331 | Low | 3.1 | 2026-09-02 | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-84327 | Medium | 6.5 | 2026-09-02 | Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sen… |
CVE-2026-78606 | Medium | 4.2 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Co… |
CVE-2026-73727 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A succes… |
CVE-2026-73724 | High | 7.1 | 2026-09-01 | Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege ope… |
CVE-2026-73723 | High | 7.1 | 2026-09-01 | A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an aut… |
CVE-2026-73708 | High | 8.3 | 2026-09-01 | A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator… |
CVE-2026-73707 | High | 8.5 | 2026-09-01 | Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege ope… |
CVE-2026-73702 | High | 8.8 | 2026-09-01 | A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege op… |
CVE-2026-72641 | Medium | 5.4 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… |
CVE-2026-72633 | Medium | 4.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by… |
CVE-2026-63137 | High | 8.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-84303 | | 2026-09-01 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header… | |
CVE-2026-58566 | High | 8.8 | 2026-09-01 | Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading t… |
CVE-2026-84206 | Medium | 4.3 | 2026-09-01 | Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to res… |
CVE-2026-74994 | | 2026-09-01 | The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, colla… | |
CVE-2026-76111 | High | 8.8 | 2026-09-01 | Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability t… |
CVE-2026-82747 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :r… | |
CVE-2026-75921 | High | 7.2 | 2026-09-01 | The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerabl… |
CVE-2026-82749 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced par… | |
CVE-2026-82748 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can ru… | |
CVE-2026-82730 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. … | |
CVE-2026-82395 | | 2026-08-31 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its pe… | |
CVE-2026-82394 | | 2026-08-31 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu… | |
CVE-2026-81892 | High | 8.1 | 2026-08-31 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a si… |
CVE-2026-50199 | Medium | 4.3 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads the first Fixer/API… |
CVE-2026-53552 | Critical | 9.6 | 2026-08-31 | Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in… |
CVE-2026-79746 | High | 8.1 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-82879 | Medium | 6.3 | 2026-08-31 | DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket… |
CVE-2026-82875 | Medium | 5.5 | 2026-08-31 | ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without veri… |
CVE-2026-68951 | Medium | 5.3 | 2026-08-31 | GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookma… |
CVE-2026-82724 | | 2026-08-31 | Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access ch… | |
CVE-2026-81643 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In… | |
CVE-2026-80223 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over Grap… | |
CVE-2026-82634 | Medium | 6.5 | 2026-08-30 | Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Ji… |
CVE-2026-81318 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed fro… | |
CVE-2026-81316 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should… | |
CVE-2026-77454 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relations… | |
CVE-2026-82463 | High | 8.1 | 2026-08-29 | pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attacker… |
CVE-2026-77786 | Medium | 4.9 | 2026-08-29 | The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires… |
CVE-2026-77704 | Low | 2.7 | 2026-08-29 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them ch… |
CVE-2026-82272 | Medium | 6.5 | 2026-08-28 | Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain access… |
CVE-2026-62904 | Medium | 5.4 | 2026-08-28 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-55485 | High | 8.8 | 2026-08-28 | Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superus… |
CVE-2026-54766 | | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go a… | |
CVE-2026-56854 | High | 7.5 | 2026-08-28 | The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyC… |
CVE-2026-18918 | | 2026-08-28 | In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, ap… | |
CVE-2026-61783 | Medium | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an au… |
CVE-2026-81729 | Medium | 6.5 | 2026-08-27 | Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php call… |
CVE-2026-77438 | High | 7.5 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the… |
CVE-2026-80209 | Medium | 4.3 | 2026-08-27 | The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIE… |
CVE-2026-59270 | Critical | 9.4 | 2026-08-27 | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all avai… |
CVE-2026-47892 | Critical | 9.8 | 2026-08-27 | A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Sp… |
CVE-2026-19454 | Medium | 4.4 | 2026-08-27 | The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an adm… |
CVE-2026-77611 | High | 7.1 | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested obj… |
CVE-2026-77317 | High | 8.1 | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a… |
CVE-2026-77298 | | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Autho… | |
CVE-2026-43621 | High | 8.1 | 2026-08-26 | Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows a… |
CVE-2026-77507 | Medium | 5.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do… |
CVE-2026-66003 | | 2026-08-26 | Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a… | |
CVE-2026-41262 | Medium | 4.3 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/latest/fleet/polici… |
CVE-2026-47841 | High | 7.4 | 2026-08-26 | An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Secur… |
CVE-2026-79619 | | 2026-08-26 | On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host pri… | |
CVE-2026-80204 | Medium | 5.4 | 2026-08-26 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController whe… |
CVE-2026-80203 | Critical | 9.8 | 2026-08-26 | The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sen… |
CVE-2026-80202 | High | 8.8 | 2026-08-26 | Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timeshe… |
CVE-2026-18985 | High | 8.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2… |
CVE-2026-16644 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. |
CVE-2026-80184 | | 2026-08-25 | In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be s… | |
CVE-2026-80182 | | 2026-08-25 | In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-live… | |
CVE-2026-68525 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access… |
CVE-2026-65182 | Critical | 9.1 | 2026-08-25 | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specif… |
CVE-2026-79262 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79261 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Controls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chr… |
CVE-2026-79258 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data vi… |