CWE-863 · Incorrect Authorization (page 8)
Page 8 of 36 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41379 | High | 7.1 | 2026-04-28 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voic… |
CVE-2026-41375 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator… |
CVE-2026-41371 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session res… |
CVE-2026-41367 | Medium | 5.0 | 2026-04-28 | OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers… |
CVE-2026-41248 | Critical | 9.1 | 2026-04-24 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypa… |
CVE-2026-41427 | Medium | 6.5 | 2026-04-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth… |
CVE-2026-30368 | Medium | 5.4 | 2026-04-24 | A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks… |
CVE-2026-25660 | Critical | 9.8 | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the U… |
CVE-2026-23902 | High | 8.1 | 2026-04-24 | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined o… |
CVE-2026-41068 | High | 7.7 | 2026-04-24 | Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyv… |
CVE-2026-41325 | High | 8.8 | 2026-04-24 | Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in… |
CVE-2026-40099 | Medium | 6.5 | 2026-04-24 | Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in… |
CVE-2026-41350 | Medium | 4.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visib… |
CVE-2026-41348 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel… |
CVE-2026-41344 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-onl… |
CVE-2026-41909 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allows limited-scope sessions to enumerate… |
CVE-2026-41908 | Medium | 4.3 | 2026-04-23 | OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.rea… |
CVE-2026-41233 | Medium | 5.4 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used… |
CVE-2026-41232 | Medium | 5.0 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender a… |
CVE-2026-5377 | Medium | 4.3 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles… |
CVE-2026-35370 | Medium | 4.4 | 2026-04-22 | The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to… |
CVE-2025-9957 | Low | 2.7 | 2026-04-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certai… |
CVE-2026-41131 | Medium | 5.0 | 2026-04-22 | OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enable… |
CVE-2026-40599 | High | 7.1 | 2026-04-21 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process… |
CVE-2026-41191 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_start_new` outside t… |
CVE-2026-41190 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabled, direct conversa… |
CVE-2026-41189 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, w… |
CVE-2026-40574 | Medium | 6.8 | 2026-04-21 | OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization bypass exists in OAuth2 Proxy as part of… |
CVE-2026-29179 | Low | 3.3 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file oper… |
CVE-2026-26274 | Medium | 6.6 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy t… |
CVE-2026-26067 | Medium | 4.9 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in… |
CVE-2026-24176 | Medium | 4.3 | 2026-04-21 | NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit… |
CVE-2026-41303 | High | 8.8 | 2026-04-21 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec ap… |
CVE-2026-34082 | Medium | 4.3 | 2026-04-20 | Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/api/installed-apps/<appId>/conversations/<conversationId>` ha… |
CVE-2026-33031 | High | 8.1 | 2026-04-20 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API to… |
CVE-2025-13480 | Medium | 6.5 | 2026-04-20 | Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API en… |
CVE-2026-39454 | High | 7.8 | 2026-04-20 | SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-admini… |
CVE-2026-32228 | High | 7.5 | 2026-04-18 | UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the… |
CVE-2026-40350 | High | 8.8 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-manageme… |
CVE-2026-40304 | Medium | 5.3 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logic… |
CVE-2026-40155 | Medium | 5.4 | 2026-04-17 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that… |
CVE-2026-40515 | High | 7.5 | 2026-04-17 | OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normal… |
CVE-2026-24749 | Medium | 5.3 | 2026-04-16 | The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in te… |
CVE-2026-39350 | Medium | 5.4 | 2026-04-15 | Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the servi… |
CVE-2026-33888 | Medium | 5.3 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery… |
CVE-2026-6383 | Medium | 5.4 | 2026-04-15 | A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading t… |
CVE-2026-4857 | High | 8.4 | 2026-04-15 | IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users as… |
CVE-2026-6290 | High | 8.0 | 2026-04-15 | Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This all… |
CVE-2025-40897 | High | 8.1 | 2026-04-15 | An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for us… |
CVE-2026-40291 | High | 8.8 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api… |
CVE-2026-24069 | Medium | 5.4 | 2026-04-14 | Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan C… |
CVE-2026-40191 | | 2026-04-10 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Secu… | |
CVE-2026-35657 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validat… |
CVE-2026-35653 | High | 8.1 | 2026-04-10 | OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator… |
CVE-2026-35619 | Medium | 4.3 | 2026-04-10 | OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements… |
CVE-2026-35596 | Medium | 4.3 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allow… |
CVE-2026-40224 | Medium | 6.7 | 2026-04-10 | In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace. |
CVE-2026-33551 | Low | 3.5 | 2026-04-10 | An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 creden… |
CVE-2026-2712 | Medium | 5.4 | 2026-04-10 | The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` functi… |
CVE-2026-35645 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic op… |
CVE-2026-35635 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-accoun… |
CVE-2026-34512 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated u… |
CVE-2026-40071 | Medium | 5.4 | 2026-04-09 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link We… |
CVE-2026-39957 | Medium | 4.3 | 2026-04-09 | Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('u… |
CVE-2026-2619 | Medium | 4.3 | 2026-04-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain cir… |
CVE-2026-1752 | Medium | 4.3 | 2026-04-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowe… |
CVE-2026-33461 | High | 7.7 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploi… |
CVE-2026-33460 | Medium | 4.3 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management… |
CVE-2026-27140 | High | 8.8 | 2026-04-08 | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. |
CVE-2026-39381 | Medium | 4.3 | 2026-04-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me… |
CVE-2026-39331 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorizati… |
CVE-2026-22682 | High | 7.1 | 2026-04-07 | OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permissi… |
CVE-2026-35604 | High | 8.1 | 2026-04-07 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when… |
CVE-2026-35586 | Medium | 6.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value(… |
CVE-2026-35491 | Medium | 6.1 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI p… |
CVE-2026-35490 | Critical | 9.8 | 2026-04-07 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to)… |
CVE-2026-5384 | Medium | 5.8 | 2026-04-07 | An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an instan… |
CVE-2026-5383 | Medium | 4.4 | 2026-04-07 | An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorr… |
CVE-2026-5382 | Low | 3.0 | 2026-04-07 | An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: In… |
CVE-2026-5381 | Low | 2.2 | 2026-04-07 | An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authoriza… |
CVE-2026-5380 | Medium | 5.3 | 2026-04-07 | An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance… |
CVE-2026-5379 | Low | 3.0 | 2026-04-07 | An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance o… |
CVE-2026-5378 | Medium | 5.8 | 2026-04-07 | An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-86… |
CVE-2026-5374 | Medium | 5.8 | 2026-04-07 | An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an in… |
CVE-2026-35464 | High | 7.5 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from m… |
CVE-2026-28808 | Critical | 9.8 | 2026-04-07 | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via s… |
CVE-2026-35442 | High | 8.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the co… |
CVE-2026-35412 | High | 7.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' TUS resumable upload endpoint (/files/tus) allows… |
CVE-2026-34972 | Medium | 5.0 | 2026-04-06 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under sp… |
CVE-2026-35029 | High | 8.8 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role… |
CVE-2026-5574 | Medium | 6.5 | 2026-04-05 | A security vulnerability has been detected in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Affected is the function deletefile of the component FsBrowseClean… |
CVE-2026-34953 | Critical | 9.1 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, whi… |
CVE-2026-27447 | Medium | 4.8 | 2026-04-03 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains… |
CVE-2025-68153 | Medium | 6.5 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2025-68152 | Medium | 4.9 | 2026-04-03 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators cal… |
CVE-2026-33105 | Critical | 10.0 | 2026-04-03 | Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32213 | Critical | 10.0 | 2026-04-03 | Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32173 | High | 8.6 | 2026-04-03 | Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network. |
CVE-2026-34376 | High | 7.5 | 2026-04-01 | PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulne… |
CVE-2025-71278 | High | 8.8 | 2026-04-01 | XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo… |