CWE-863 · Incorrect Authorization (page 9)
Page 9 of 42 — CVEs classified under CWE-863, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14923 | Medium | 6.5 | 2026-07-30 | The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates pos… |
CVE-2026-48449 | Critical | 10.0 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-67439 | Medium | 4.3 | 2026-07-29 | OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait… |
CVE-2026-65975 | Medium | 6.5 | 2026-07-29 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0… |
CVE-2026-6336 | Medium | 5.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2025-14562 | Low | 3.1 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-18236 | | 2026-07-29 | A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject event… | |
CVE-2026-54693 | | 2026-07-29 | ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4.0.0 until 4.15.1, the email and phone… | |
CVE-2026-18255 | High | 7.2 | 2026-07-29 | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allo… |
CVE-2026-44944 | | 2026-07-29 | An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscs… | |
CVE-2026-58159 | High | 8.2 | 2026-07-29 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2025-10656 | Critical | 9.8 | 2026-07-29 | The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and… |
CVE-2026-58156 | Medium | 4.9 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0… |
CVE-2026-66064 | Medium | 5.3 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using… |
CVE-2026-54719 | High | 7.5 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file=… |
CVE-2026-48396 | High | 8.6 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker co… |
CVE-2026-48390 | High | 8.2 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain… |
CVE-2026-7868 | Medium | 6.5 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privile… |
CVE-2026-14167 | High | 8.8 | 2026-07-28 | A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incor… |
CVE-2026-43672 | High | 7.1 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A mali… |
CVE-2026-42016 | High | 8.1 | 2026-07-27 | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issue… |
CVE-2026-17568 | High | 8.8 | 2026-07-27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group… |
CVE-2026-17530 | Medium | 6.3 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr… |
CVE-2026-17529 | Medium | 6.3 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati… |
CVE-2026-59689 | High | 8.0 | 2026-07-27 | An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an aut… |
CVE-2026-17039 | Low | 3.1 | 2026-07-24 | A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path… |
CVE-2026-8789 | High | 8.1 | 2026-07-24 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification… |
CVE-2026-15704 | Critical | 9.8 | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent tr… |
CVE-2026-15630 | Critical | 9.9 | 2026-07-23 | A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch… |
CVE-2026-59678 | | 2026-07-23 | An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network confi… | |
CVE-2026-13068 | Medium | 4.2 | 2026-07-22 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, di… |
CVE-2026-13067 | Medium | 6.3 | 2026-07-22 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATr… |
CVE-2026-13061 | Medium | 4.3 | 2026-07-22 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information… |
CVE-2026-13060 | Medium | 6.5 | 2026-07-22 | An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in… |
CVE-2026-65602 | High | 8.8 | 2026-07-22 | Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport referen… |
CVE-2026-65601 | High | 8.8 | 2026-07-22 | Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[]… |
CVE-2026-65596 | High | 8.1 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Que… |
CVE-2026-65594 | Medium | 6.5 | 2026-07-22 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the a… |
CVE-2026-65015 | High | 8.8 | 2026-07-22 | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization check… |
CVE-2026-63145 | Medium | 4.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not… |
CVE-2026-63142 | Medium | 5.0 | 2026-07-21 | Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request re… |
CVE-2026-61325 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is… |
CVE-2026-61012 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60951 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60723 | High | 8.4 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-60663 | Critical | 9.9 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60625 | High | 7.8 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). Supported versions that are affected are 12.2.1.4.0 and… |
CVE-2026-60320 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2… |
CVE-2026-43947 | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secure… | |
CVE-2026-43946 | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows una… | |
CVE-2026-43945 | | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full… | |
CVE-2026-65054 | Low | 3.1 | 2026-07-21 | MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by ad… |
CVE-2026-47697 | High | 7.1 | 2026-07-21 | Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoi… |
CVE-2026-56146 | Medium | 5.4 | 2026-07-21 | Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclos… |
CVE-2026-56144 | Medium | 5.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls… |
CVE-2026-49092 | Medium | 4.3 | 2026-07-21 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly… |
CVE-2026-47407 | | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/… | |
CVE-2026-15829 | High | 8.1 | 2026-07-21 | A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapi… |
CVE-2026-65049 | Critical | 9.3 | 2026-07-21 | Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to tr… |
CVE-2026-59851 | High | 8.8 | 2026-07-21 | A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is au… |
CVE-2026-47128 | Medium | 6.1 | 2026-07-20 | nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to loca… |
CVE-2026-64651 | | 2026-07-20 | The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests f… | |
CVE-2026-64650 | | 2026-07-20 | The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29… | |
CVE-2026-44231 | Critical | 9.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information discl… |
CVE-2026-63755 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE K… |
CVE-2026-63751 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protecte… |
CVE-2026-63749 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $b… |
CVE-2026-63742 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries o… |
CVE-2026-63740 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead… |
CVE-2026-63738 | Medium | 4.3 | 2026-07-20 | SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals… |
CVE-2026-63733 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement… |
CVE-2026-10755 | Low | 2.7 | 2026-07-20 | The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-… |
CVE-2026-16215 | Medium | 6.5 | 2026-07-19 | A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Per… |
CVE-2026-16200 | High | 7.3 | 2026-07-19 | A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the compone… |
CVE-2026-16197 | Medium | 6.3 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/f… |
CVE-2026-16195 | Medium | 6.3 | 2026-07-18 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of… |
CVE-2026-10130 | High | 8.2 | 2026-07-18 | QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submi… |
CVE-2026-16126 | High | 7.3 | 2026-07-18 | A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c o… |
CVE-2026-16123 | Medium | 6.3 | 2026-07-18 | A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file interna… |
CVE-2026-16122 | Medium | 4.3 | 2026-07-18 | A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesA… |
CVE-2026-16119 | Medium | 6.3 | 2026-07-18 | A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the… |
CVE-2025-71390 | High | 8.8 | 2026-07-18 | SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restriction… |
CVE-2026-47866 | High | 8.3 | 2026-07-18 | VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane… |
CVE-2026-55518 | Critical | 9.6 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<associati… |
CVE-2026-54244 | Low | 3.5 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in… |
CVE-2026-4938 | Medium | 6.5 | 2026-07-17 | IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-63309 | Medium | 4.3 | 2026-07-17 | SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restrict… |
CVE-2026-63097 | Medium | 4.3 | 2026-07-17 | Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticat… |
CVE-2026-14871 | | 2026-07-17 | osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-… | |
CVE-2026-16017 | Medium | 6.3 | 2026-07-17 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron… |
CVE-2026-62231 | High | 8.1 | 2026-07-17 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the Ap… |
CVE-2026-62228 | High | 8.8 | 2026-07-17 | OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their i… |
CVE-2026-62225 | Medium | 5.4 | 2026-07-17 | OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persis… |
CVE-2026-62224 | Medium | 5.4 | 2026-07-17 | OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with low… |
CVE-2026-62223 | High | 8.8 | 2026-07-17 | OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions… |
CVE-2026-62221 | Medium | 5.4 | 2026-07-17 | OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled… |
CVE-2026-62219 | High | 7.1 | 2026-07-17 | OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured i… |
CVE-2026-62217 | High | 8.8 | 2026-07-17 | OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lowe… |
CVE-2026-62209 | High | 8.1 | 2026-07-17 | OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsA… |
CVE-2026-62202 | High | 8.8 | 2026-07-17 | OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied… |