CWE-863: Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource, but it does not correctly perform the check.

707
Total CVEs
138
Critical
312
High
7.3
Avg CVSS
3
In CISA KEV

Yearly Trend

2026
77
2025
260
2024
164
2023
97
2022
35

Top Affected Vendors

1 Oracle 34
2 Apple 26
3 Adobe 22
4 Google 19
5 Mattermost 18
6 Gitlab 16
7 Ibm 13
8 Apache 10
9 Wso2 7
10 Lunary 7

All Incorrect Authorization CVEs (707)

CVE-2025-48935
9.1

This vulnerability allows attackers to bypass Deno's permission system for database read/write operations using the ATTACH DATABASE SQL statement. It ...

Jun 4, 2025
CVE-2025-48373
9.1

This vulnerability allows attackers to bypass authentication in the Schule school management system by manipulating client-side JavaScript role valida...

May 22, 2025
CVE-2025-43561
9.1

This CVE describes an incorrect authorization vulnerability in Adobe ColdFusion that allows high-privileged attackers to bypass authentication mechani...

May 13, 2025
CVE-2024-38392
9.1

This vulnerability in Pexip Infinity Connect allows remote attackers to execute arbitrary code by exploiting insufficient authenticity checks when loa...

Apr 2, 2025
CVE-2025-24434
9.1

CVE-2025-24434 is an incorrect authorization vulnerability in Adobe Commerce that allows attackers to bypass security controls and escalate privileges...

Feb 11, 2025
CVE-2024-54530
9.1

This vulnerability allows password autofill to fill passwords even after authentication fails, potentially exposing credentials. It affects users of A...

Jan 27, 2025
CVE-2024-54512
9.1

A system binary vulnerability in Apple operating systems could allow an attacker to fingerprint a user's Apple Account, potentially revealing account ...

Jan 27, 2025
CVE-2024-53553
9.1

This vulnerability allows attackers to bypass authentication in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 by sending specially crafted web requests...

Jan 16, 2025
CVE-2024-13281
9.1

This CVE describes an incorrect authorization vulnerability in Drupal's Monster Menus module that allows forceful browsing (unauthorized access to res...

Jan 9, 2025
CVE-2024-13277
9.1

This vulnerability allows attackers to bypass authorization controls in Drupal Smart IP Ban module, enabling forceful browsing to access restricted co...

Jan 9, 2025
CVE-2024-13253
9.1

This CVE describes an incorrect authorization vulnerability in Drupal's Advanced PWA inc Push Notifications module that allows forceful browsing. Atta...

Jan 9, 2025
CVE-2024-54662
9.1

CVE-2024-54662 is an incorrect access control vulnerability in Dante SOCKS proxy server that allows bypassing authentication restrictions when using c...

Dec 17, 2024
CVE-2024-52732
9.1

CVE-2024-52732 is an incorrect access control vulnerability in wms-Warehouse management system-zeqp v2.20.9.1 where token values are reused, allowing ...

Dec 2, 2024
CVE-2024-44217
9.1

This CVE describes an authentication bypass vulnerability in Apple's password autofill feature. When exploited, it allows unauthorized access to passw...

Oct 28, 2024
CVE-2024-48772
9.1

This vulnerability in C-CHIP mobile app v1.2.8 allows remote attackers to extract sensitive information through the firmware update process. Attackers...

Oct 11, 2024
CVE-2024-48778
9.1

A vulnerability in GIANT MANUFACTURING's RideLink app (version 2.0.7) allows remote attackers to access sensitive information through the firmware upd...

Oct 11, 2024
CVE-2024-48786
9.1

This vulnerability in SwitchBot's mobile app allows remote attackers to access sensitive information during firmware updates. Attackers can intercept ...

Oct 11, 2024
CVE-2024-48769
9.1

This vulnerability in BURG-WCHTER KG's de.burgwachter.keyapp.app version 4.5.0 allows remote attackers to obtain sensitive information through the fir...

Oct 11, 2024
CVE-2024-45160
9.1

This vulnerability allows attackers to bypass OAuth2 client authentication in LemonLDAP::NG by sending an empty client_password parameter. Attackers c...

Oct 9, 2024
CVE-2024-42773
9.1

An unauthenticated attacker can edit hotel room entries in the administrator section of Kashipara Hotel Management System v1.0 due to incorrect access...

Aug 22, 2024
CVE-2024-35187
9.1

This vulnerability in Stalwart Mail Server allows attackers with arbitrary code execution as the stalwart-mail user (including web interface admins) t...

May 16, 2024
CVE-2024-1740
9.1

This vulnerability allows users who have been removed from an organization to continue accessing and manipulating logs and project data using old auth...

Apr 10, 2024
CVE-2023-33468
9.1

This vulnerability allows remote attackers to extract connection confirmation codes from KramerAV VIA Connect (2) and VIA Go (2) devices without physi...

Aug 9, 2023
CVE-2023-34218
9.1

This vulnerability in JetBrains TeamCity allows attackers to bypass permission checks and perform administrative actions without proper authorization....

May 31, 2023
CVE-2023-23304
9.1

This vulnerability in Garmin's Connect IQ platform allows malicious applications to access sensor history data without user permission. It affects Gar...

May 23, 2023
CVE-2023-23947
9.1

Argo CD versions 2.3.0-rc1 through 2.6.1 contain an improper authorization vulnerability that allows users with cluster secret update permissions to m...

Feb 16, 2023
CVE-2022-0670
9.1

This vulnerability in OpenStack Manila's Ceph filesystem integration allows a share owner to read or write any Manila share or the entire filesystem, ...

Jul 25, 2022
CVE-2022-26629
9.1

This vulnerability allows attackers to bypass the lock screen security feature in SoroushPlus+ Messenger 1.0.30 due to insufficient access controls. I...

Mar 24, 2022
CVE-2021-30925
9.1

This vulnerability allows malicious applications to bypass privacy preferences on Apple devices, potentially accessing sensitive user data without pro...

Aug 24, 2021
CVE-2021-30856
9.1

This macOS vulnerability allows malicious unsandboxed applications to bypass Privacy preferences when Remote Login is enabled. Attackers could gain un...

Aug 24, 2021
CVE-2021-26040
9.1

This vulnerability allows authenticated users with media manager access to delete files without proper permission checks in Joomla! 4.0.0. Attackers c...

Aug 24, 2021
CVE-2021-20538
9.1

CVE-2021-20538 is an incorrect authorization vulnerability in IBM Cloud Pak for Security that allows authenticated users to access sensitive informati...

May 10, 2021
CVE-2021-29943
9.1

This vulnerability in Apache Solr's ConfigurableInternodeAuthHadoopPlugin causes distributed requests to be forwarded using server credentials instead...

Apr 13, 2021
CVE-2025-55205
9.0

A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system name...

Aug 18, 2025
CVE-2025-30171
9.0

This vulnerability in ASPECT systems allows attackers with compromised administrator credentials to delete system files, potentially causing service d...

May 22, 2025
CVE-2023-46241
9.0

The CVE-2023-46241 vulnerability in the discourse-microsoft-auth plugin allows attackers to potentially take control of victims' Discourse accounts th...

Feb 21, 2024
CVE-2017-9453
9.0

CVE-2017-9453 is an authentication bypass vulnerability in BMC Server Automation that allows attackers to execute arbitrary commands through the Proce...

Sep 5, 2023
CVE-2023-31997
9.0

UniFi OS 3.1 introduces a misconfiguration that allows local network users to directly access MongoDB on affected Cloud Key devices. This vulnerabilit...

Jul 1, 2023
CVE-2023-52077
8.9

Nexkey, a lightweight fork of Misskey, allowed external applications using administrator or moderator tokens to call administrative APIs. This vulnera...

Dec 27, 2023
CVE-2026-25232
8.8

This CVE describes an access control bypass vulnerability in Gogs self-hosted Git service where users with Write permissions can delete protected bran...

Feb 19, 2026
CVE-2026-24851
8.8

OpenFGA versions 1.8.5 to 1.11.2 have an improper policy enforcement vulnerability that can allow unauthorized access when specific authorization mode...

Feb 6, 2026
CVE-2026-25040
8.8

This vulnerability allows Creator-level users in Budibase to bypass UI restrictions and invite new users with any role (including Admin) via API manip...

Jan 29, 2026
CVE-2026-24428
8.8

This vulnerability allows authenticated low-privileged users to change the administrator password on Tenda W30E V2 routers by exploiting an authorizat...

Jan 26, 2026
CVE-2025-14866
8.8

The Melapress Role Editor WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or hi...

Jan 23, 2026
CVE-2026-22822
8.8

The External Secrets Operator's getSecretKey template function allows cross-namespace secret retrieval, bypassing Kubernetes RBAC controls. This affec...

Jan 21, 2026
CVE-2025-66360
8.8

Logpoint versions before 7.7.0 have an access control misconfiguration that allows li-admin users to access sensitive Redis service information. This ...

Nov 28, 2025
CVE-2025-62730
8.8

SOPlanning users with the user_manage_team role can assign administrative permissions to any user, including themselves, allowing privilege escalation...

Nov 20, 2025
CVE-2025-37736
8.8

This CVE describes an improper authorization vulnerability in Elastic Cloud Enterprise where the built-in readonly user can access privileged APIs tha...

Nov 7, 2025
CVE-2025-36120
8.8

This vulnerability allows authenticated users in IBM Storage Virtualize to escalate privileges via SSH sessions due to improper authorization checks. ...

Aug 18, 2025
CVE-2025-30751
8.8

This vulnerability in Oracle Database allows attackers with low privileges (Create Session and Create Procedure) to gain complete control over the dat...

Jul 15, 2025

About Incorrect Authorization (CWE-863)

The product performs an authorization check when an actor attempts to access a resource, but it does not correctly perform the check.

Our database tracks 707 CVEs classified as CWE-863, with 138 rated critical and 312 rated high severity. The average CVSS score for Incorrect Authorization vulnerabilities is 7.3.

External reference: View CWE-863 on MITRE CWE →

Monitor Incorrect Authorization Vulnerabilities

Get alerted when new Incorrect Authorization CVEs affect your infrastructure.

Start Monitoring Free