CWE-863 · Incorrect Authorization (page 6)
Page 6 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-80203 | Critical | 9.8 | 2026-08-26 | The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sen… |
CVE-2026-80202 | High | 8.8 | 2026-08-26 | Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timeshe… |
CVE-2026-18985 | High | 8.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2… |
CVE-2026-16644 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. |
CVE-2026-80184 | | 2026-08-25 | In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be s… | |
CVE-2026-80182 | | 2026-08-25 | In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-live… | |
CVE-2026-68525 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access… |
CVE-2026-65182 | Critical | 9.1 | 2026-08-25 | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specif… |
CVE-2026-79262 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79261 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Controls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chr… |
CVE-2026-79258 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data vi… |
CVE-2026-79248 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-79238 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin p… |
CVE-2026-79237 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (C… |
CVE-2026-79228 | Low | 3.1 | 2026-08-25 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-79225 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass syst… |
CVE-2026-79222 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-insta… |
CVE-2026-79218 | High | 8.3 | 2026-08-25 | Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially ex… |
CVE-2026-79217 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafte… |
CVE-2026-79213 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions… |
CVE-2026-79211 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrict… |
CVE-2026-79205 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79199 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML pa… |
CVE-2026-79191 | Low | 3.1 | 2026-08-25 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leverag… |
CVE-2026-79190 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web… |
CVE-2026-79186 | Low | 3.1 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site is… |
CVE-2026-79179 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML p… |
CVE-2026-79178 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin… |
CVE-2026-79177 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2026-79174 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web… |
CVE-2026-79152 | Critical | 9.8 | 2026-08-25 | Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-insta… |
CVE-2026-79143 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access r… |
CVE-2026-79141 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79137 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access r… |
CVE-2026-79136 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-79134 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML pa… |
CVE-2026-79133 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Ch… |
CVE-2026-79107 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in TabGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via crafted ne… |
CVE-2026-79093 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML p… |
CVE-2026-79088 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access r… |
CVE-2026-79082 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-79077 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML… |
CVE-2026-79060 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-79051 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom… |
CVE-2026-79050 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML pa… |
CVE-2026-79038 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page… |
CVE-2026-79023 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (… |
CVE-2026-79005 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-79003 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-79002 | Low | 3.1 | 2026-08-25 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass s… |
CVE-2026-78975 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro… |
CVE-2026-78961 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social… |
CVE-2026-78954 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web… |
CVE-2026-78946 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom… |
CVE-2026-78911 | High | 8.3 | 2026-08-25 | Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social… |
CVE-2026-78907 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page… |
CVE-2026-78898 | Medium | 5.4 | 2026-08-25 | Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access re… |
CVE-2026-78892 | High | 7.1 | 2026-08-25 | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a… |
CVE-2026-78887 | Low | 3.7 | 2026-08-25 | A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Execut… |
CVE-2026-79673 | Medium | 6.5 | 2026-08-25 | Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An at… |
CVE-2026-49050 | High | 8.8 | 2026-08-25 | General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade t… |
CVE-2026-77134 | | 2026-08-25 | The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainabl… | |
CVE-2026-56710 | Critical | 9.8 | 2026-08-25 | Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with a… |
CVE-2026-75542 | | 2026-08-24 | Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organiza… | |
CVE-2026-77923 | Medium | 4.3 | 2026-08-24 | Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check wi… |
CVE-2026-71510 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensit… |
CVE-2026-71506 | High | 8.1 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoi… |
CVE-2026-76836 | High | 8.8 | 2026-08-24 | AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config propert… |
CVE-2026-19685 | High | 7.1 | 2026-08-24 | NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix… |
CVE-2026-67204 | Medium | 5.4 | 2026-08-24 | BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to ma… |
CVE-2025-63080 | | 2026-08-24 | Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. sy… | |
CVE-2026-62382 | | 2026-08-22 | PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push… | |
CVE-2026-60083 | Medium | 4.9 | 2026-08-22 | SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by… |
CVE-2026-4245 | Medium | 4.3 | 2026-08-22 | The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post… |
CVE-2026-77234 | High | 8.8 | 2026-08-21 | Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context… |
CVE-2026-62941 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`Allo… |
CVE-2026-62313 | Medium | 4.3 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be… |
CVE-2026-59318 | Medium | 6.5 | 2026-08-21 | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatche… |
CVE-2026-17559 | Medium | 5.3 | 2026-08-21 | The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global passw… |
CVE-2026-16577 | Low | 2.7 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against t… |
CVE-2026-69555 | Critical | 10.0 | 2026-08-20 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-76019 | High | 8.1 | 2026-08-20 | Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-54136 | | 2026-08-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could… | |
CVE-2026-7485 | | 2026-08-20 | Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricte… | |
CVE-2026-14949 | Medium | 6.5 | 2026-08-20 | A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new a… |
CVE-2026-19699 | Low | 2.7 | 2026-08-20 | The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor… |
CVE-2026-76391 | High | 8.3 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access… |
CVE-2026-76370 | Medium | 4.3 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the n… |
CVE-2026-76342 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language (… |
CVE-2026-76341 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Process… |
CVE-2026-68561 | High | 8.8 | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSor… |
CVE-2026-55089 | Critical | 9.9 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authoriz… |
CVE-2026-54742 | | 2026-08-19 | Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in… | |
CVE-2026-17063 | High | 7.9 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the… |
CVE-2026-55643 | High | 8.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because… |
CVE-2026-50550 | Medium | 5.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through a… |
CVE-2026-49976 | Medium | 6.5 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of… |
CVE-2026-19198 | | 2026-08-19 | Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21. | |
CVE-2026-17429 | High | 8.1 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9)… |
CVE-2026-17183 | High | 7.1 | 2026-08-19 | An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side e… |