CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource, but it does not correctly perform the check.
Yearly Trend
Top Affected Vendors
All Incorrect Authorization CVEs (707)
This vulnerability allows attackers to bypass Deno's permission system for database read/write operations using the ATTACH DATABASE SQL statement. It ...
Jun 4, 2025This vulnerability allows attackers to bypass authentication in the Schule school management system by manipulating client-side JavaScript role valida...
May 22, 2025This CVE describes an incorrect authorization vulnerability in Adobe ColdFusion that allows high-privileged attackers to bypass authentication mechani...
May 13, 2025This vulnerability in Pexip Infinity Connect allows remote attackers to execute arbitrary code by exploiting insufficient authenticity checks when loa...
Apr 2, 2025CVE-2025-24434 is an incorrect authorization vulnerability in Adobe Commerce that allows attackers to bypass security controls and escalate privileges...
Feb 11, 2025This vulnerability allows password autofill to fill passwords even after authentication fails, potentially exposing credentials. It affects users of A...
Jan 27, 2025A system binary vulnerability in Apple operating systems could allow an attacker to fingerprint a user's Apple Account, potentially revealing account ...
Jan 27, 2025This vulnerability allows attackers to bypass authentication in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 by sending specially crafted web requests...
Jan 16, 2025This CVE describes an incorrect authorization vulnerability in Drupal's Monster Menus module that allows forceful browsing (unauthorized access to res...
Jan 9, 2025This vulnerability allows attackers to bypass authorization controls in Drupal Smart IP Ban module, enabling forceful browsing to access restricted co...
Jan 9, 2025This CVE describes an incorrect authorization vulnerability in Drupal's Advanced PWA inc Push Notifications module that allows forceful browsing. Atta...
Jan 9, 2025CVE-2024-54662 is an incorrect access control vulnerability in Dante SOCKS proxy server that allows bypassing authentication restrictions when using c...
Dec 17, 2024CVE-2024-52732 is an incorrect access control vulnerability in wms-Warehouse management system-zeqp v2.20.9.1 where token values are reused, allowing ...
Dec 2, 2024This CVE describes an authentication bypass vulnerability in Apple's password autofill feature. When exploited, it allows unauthorized access to passw...
Oct 28, 2024This vulnerability in C-CHIP mobile app v1.2.8 allows remote attackers to extract sensitive information through the firmware update process. Attackers...
Oct 11, 2024A vulnerability in GIANT MANUFACTURING's RideLink app (version 2.0.7) allows remote attackers to access sensitive information through the firmware upd...
Oct 11, 2024This vulnerability in SwitchBot's mobile app allows remote attackers to access sensitive information during firmware updates. Attackers can intercept ...
Oct 11, 2024This vulnerability in BURG-WCHTER KG's de.burgwachter.keyapp.app version 4.5.0 allows remote attackers to obtain sensitive information through the fir...
Oct 11, 2024This vulnerability allows attackers to bypass OAuth2 client authentication in LemonLDAP::NG by sending an empty client_password parameter. Attackers c...
Oct 9, 2024An unauthenticated attacker can edit hotel room entries in the administrator section of Kashipara Hotel Management System v1.0 due to incorrect access...
Aug 22, 2024This vulnerability in Stalwart Mail Server allows attackers with arbitrary code execution as the stalwart-mail user (including web interface admins) t...
May 16, 2024This vulnerability allows users who have been removed from an organization to continue accessing and manipulating logs and project data using old auth...
Apr 10, 2024This vulnerability allows remote attackers to extract connection confirmation codes from KramerAV VIA Connect (2) and VIA Go (2) devices without physi...
Aug 9, 2023This vulnerability in JetBrains TeamCity allows attackers to bypass permission checks and perform administrative actions without proper authorization....
May 31, 2023This vulnerability in Garmin's Connect IQ platform allows malicious applications to access sensor history data without user permission. It affects Gar...
May 23, 2023Argo CD versions 2.3.0-rc1 through 2.6.1 contain an improper authorization vulnerability that allows users with cluster secret update permissions to m...
Feb 16, 2023This vulnerability in OpenStack Manila's Ceph filesystem integration allows a share owner to read or write any Manila share or the entire filesystem, ...
Jul 25, 2022This vulnerability allows attackers to bypass the lock screen security feature in SoroushPlus+ Messenger 1.0.30 due to insufficient access controls. I...
Mar 24, 2022This vulnerability allows malicious applications to bypass privacy preferences on Apple devices, potentially accessing sensitive user data without pro...
Aug 24, 2021This macOS vulnerability allows malicious unsandboxed applications to bypass Privacy preferences when Remote Login is enabled. Attackers could gain un...
Aug 24, 2021This vulnerability allows authenticated users with media manager access to delete files without proper permission checks in Joomla! 4.0.0. Attackers c...
Aug 24, 2021CVE-2021-20538 is an incorrect authorization vulnerability in IBM Cloud Pak for Security that allows authenticated users to access sensitive informati...
May 10, 2021This vulnerability in Apache Solr's ConfigurableInternodeAuthHadoopPlugin causes distributed requests to be forwarded using server credentials instead...
Apr 13, 2021A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system name...
Aug 18, 2025This vulnerability in ASPECT systems allows attackers with compromised administrator credentials to delete system files, potentially causing service d...
May 22, 2025The CVE-2023-46241 vulnerability in the discourse-microsoft-auth plugin allows attackers to potentially take control of victims' Discourse accounts th...
Feb 21, 2024CVE-2017-9453 is an authentication bypass vulnerability in BMC Server Automation that allows attackers to execute arbitrary commands through the Proce...
Sep 5, 2023UniFi OS 3.1 introduces a misconfiguration that allows local network users to directly access MongoDB on affected Cloud Key devices. This vulnerabilit...
Jul 1, 2023Nexkey, a lightweight fork of Misskey, allowed external applications using administrator or moderator tokens to call administrative APIs. This vulnera...
Dec 27, 2023This CVE describes an access control bypass vulnerability in Gogs self-hosted Git service where users with Write permissions can delete protected bran...
Feb 19, 2026OpenFGA versions 1.8.5 to 1.11.2 have an improper policy enforcement vulnerability that can allow unauthorized access when specific authorization mode...
Feb 6, 2026This vulnerability allows Creator-level users in Budibase to bypass UI restrictions and invite new users with any role (including Admin) via API manip...
Jan 29, 2026This vulnerability allows authenticated low-privileged users to change the administrator password on Tenda W30E V2 routers by exploiting an authorizat...
Jan 26, 2026The Melapress Role Editor WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or hi...
Jan 23, 2026The External Secrets Operator's getSecretKey template function allows cross-namespace secret retrieval, bypassing Kubernetes RBAC controls. This affec...
Jan 21, 2026Logpoint versions before 7.7.0 have an access control misconfiguration that allows li-admin users to access sensitive Redis service information. This ...
Nov 28, 2025SOPlanning users with the user_manage_team role can assign administrative permissions to any user, including themselves, allowing privilege escalation...
Nov 20, 2025This CVE describes an improper authorization vulnerability in Elastic Cloud Enterprise where the built-in readonly user can access privileged APIs tha...
Nov 7, 2025This vulnerability allows authenticated users in IBM Storage Virtualize to escalate privileges via SSH sessions due to improper authorization checks. ...
Aug 18, 2025This vulnerability in Oracle Database allows attackers with low privileges (Create Session and Create Procedure) to gain complete control over the dat...
Jul 15, 2025About Incorrect Authorization (CWE-863)
The product performs an authorization check when an actor attempts to access a resource, but it does not correctly perform the check.
Our database tracks 707 CVEs classified as CWE-863, with 138 rated critical and 312 rated high severity. The average CVSS score for Incorrect Authorization vulnerabilities is 7.3.
External reference: View CWE-863 on MITRE CWE →
Monitor Incorrect Authorization Vulnerabilities
Get alerted when new Incorrect Authorization CVEs affect your infrastructure.
Start Monitoring Free