CWE-863— Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.— MITRE CWE catalog

5,086 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-863page 32 of 102

CVE-2022-31087HIGHCVSS 7.8EG 7.8
2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (…
CVE-2021-26258HIGHCVSS 7.8EG 7.8
2022-05-12
Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potentially enable escalation of privilege via local access.
CVE-2022-30594HIGHCVSS 7.8EG 7.8
2022-05-12
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
CVE-2021-39802HIGHCVSS 7.8EG 7.8
2022-04-12
In change_pte_range of mprotect.c , there is a possible way to make a shared mmap writable due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…
CVE-2021-39799HIGHCVSS 7.8EG 7.8
2022-04-12
In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…
CVE-2021-0694HIGHCVSS 7.8EG 7.8
2022-04-12
In setServiceForegroundInnerLocked of ActiveServices.java, there is a possible way for a background application to regain foreground permissions due to insufficient background restrictions. This could lead to local escalation of privilege …
CVE-2022-20762HIGHCVSS 7.8EG 7.8
2022-04-06
A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could allow an authenticated, local attacker to escalate privileges on an affected devic…
CVE-2022-20002HIGHCVSS 7.8EG 7.8
2022-03-30
In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.P…
CVE-2021-39790HIGHCVSS 7.8EG 7.8
2022-03-30
In Dialer, there is a possible way to manipulate visual voicemail settings due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for e…
CVE-2021-39789HIGHCVSS 7.8EG 7.8
2022-03-30
In Telecom, there is a possible leak of TTY mode change due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Pro…
CVE-2021-39750HIGHCVSS 7.8EG 7.8
2022-03-30
In PackageManager, there is a possible way to change the splash screen theme of other apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
CVE-2021-39749HIGHCVSS 7.8EG 7.8
2022-03-30
In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…
CVE-2021-39743HIGHCVSS 7.8EG 7.8
2022-03-30
In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…
CVE-2022-22618HIGHCVSS 7.8EG 7.8
2022-03-18
This issue was addressed with improved checks. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4. A user may be able to bypass the Emergency SOS passcode prompt.
CVE-2021-41850HIGHCVSS 7.8EG 7.8
2022-03-11
An issue was discovered in Luna Simo PPR1.180610.011/202001031830. A pre-installed app with a package name of com.skyroam.silverhelper writes three IMEI values to system properties at system startup. The system property values can be obtai…
CVE-2021-42855HIGHCVSS 7.8EG 7.8
2022-03-10
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by…
CVE-2019-25058HIGHCVSS 7.8EG 7.8
2022-02-24
An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future.
CVE-2021-22042HIGHCVSS 7.8EG 7.8
2022-02-16
VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high…
CVE-2022-21825HIGHCVSS 7.8EG 7.8
2022-02-09
An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation.
CVE-2022-21174HIGHCVSS 7.8EG 7.8
2022-02-09
Improper access control in a third-party component of Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-37109HIGHCVSS 7.8EG 7.8
2022-02-09
There is a security protection bypass vulnerability with the modem.Successful exploitation of this vulnerability may cause memory protection failure.
CVE-2021-23152HIGHCVSS 7.8EG 7.8
2022-02-09
Improper access control in the Intel(R) Advisor software before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-0164HIGHCVSS 7.8EG 7.8
2022-02-09
Improper access control in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
CVE-2021-37852HIGHCVSS 7.8EG 7.8
2022-02-09
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
CVE-2021-44204HIGHCVSS 7.8EG 7.8
2022-02-04
Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect …
CVE-2022-23033HIGHCVSS 7.8EG 7.8
2022-01-25
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do no…
CVE-2020-14110HIGHCVSS 7.8EG 7.8
2022-01-18
AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background.
CVE-2021-39630HIGHCVSS 7.8EG 7.8
2022-01-14
In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges ne…
CVE-2021-45339HIGHCVSS 7.8EG 7.8
2021-12-27
Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense.
CVE-2021-0649HIGHCVSS 7.8EG 7.8
2021-12-15
In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. This could lead to local escalation of privilege CONTROL_ALWAYS_ON_VPN with no additional execution privileges needed. User interaction is no…
CVE-2021-43771HIGHCVSS 7.8EG 7.8
2021-11-30
Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation with…
CVE-2021-33118HIGHCVSS 7.8EG 7.8
2021-11-17
Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-33058HIGHCVSS 7.8EG 7.8
2021-11-17
Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
CVE-2021-0151HIGHCVSS 7.8EG 7.8
2021-11-17
Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-42954HIGHCVSS 7.8EG 7.8
2021-11-17
Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user grou…
CVE-2021-42725HIGHCVSS 7.8EG 7.8
2021-11-16
Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interac…
CVE-2021-0645HIGHCVSS 7.8EG 7.8
2021-08-17
In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege, allowing an app to read private app directories in external storage, which should be restrict…
CVE-2021-38608HIGHCVSS 7.8EG 7.8
2021-08-16
Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent.
CVE-2021-37841HIGHCVSS 7.8EG 7.8
2021-08-12
Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V is…
CVE-2021-1107HIGHCVSS 7.8EG 7.8
2021-08-11
NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVMAP_IOC_WRITE* paths, where improper access controls may lead to code execution, complete denial of service, and seriously compromised integrity of all system components.
CVE-2021-0196HIGHCVSS 7.8EG 7.8
2021-08-11
Improper access control in kernel mode driver for some Intel(R) NUC 9 Extreme Laptop Kits before version 2.2.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2021-22385HIGHCVSS 7.8EG 7.8
2021-08-10
A component of the Huawei smartphone has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution.
CVE-2021-30577HIGHCVSS 7.8EG 7.8
2021-08-03
Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file.
CVE-2021-25440HIGHCVSS 7.8EG 7.8
2021-07-08
Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated privilege.
CVE-2021-25438HIGHCVSS 7.8EG 7.8
2021-07-08
Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause local file inclusion in webview.
CVE-2021-34110HIGHCVSS 7.8EG 7.8
2021-07-08
WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.
CVE-2021-26273HIGHCVSS 7.8EG 7.8
2021-07-07
The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
CVE-2021-22361HIGHCVSS 7.8EG 7.8
2021-06-22
There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. A file access is not authorized correctly. Attacker with low access may launch privilege escalation…
CVE-2010-2525HIGHCVSS 7.8EG 7.8
2021-06-22
A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system.
CVE-2021-0571HIGHCVSS 7.8EG 7.8
2021-06-22
In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, there is possible access to restricted activities due to a permissions bypass. This could lead to local …

Map vulnerabilities like CWE-863 to your infrastructure

EchelonGraph correlates every CVE — across CWE-863 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →