CWE-863— Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.— MITRE CWE catalog

5,086 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-863page 33 of 102

CVE-2021-0505HIGHCVSS 7.8EG 7.8
2021-06-21
In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2021-0472HIGHCVSS 7.8EG 7.8
2021-06-11
In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User …
CVE-2021-25418HIGHCVSS 7.8EG 7.8
2021-06-11
Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition.
CVE-2021-25412HIGHCVSS 7.8EG 7.8
2021-06-11
An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system privilege via untrusted applications.
CVE-2021-25401HIGHCVSS 7.8EG 7.8
2021-06-11
Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action.
CVE-2021-25400HIGHCVSS 7.8EG 7.8
2021-06-11
Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.
CVE-2021-32460HIGHCVSS 7.8EG 7.8
2021-06-03
The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability in the installer which could allow a local attacker to escalate privileges on a target machine. Please note than an atta…
CVE-2020-10145HIGHCVSS 7.8EG 7.8
2021-05-27
The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in this directory structure, which creates a …
CVE-2021-31728HIGHCVSS 7.8EG 7.8
2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executabl…
CVE-2021-31727HIGHCVSS 7.8EG 7.8
2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\Zema…
CVE-2021-31165HIGHCVSS 7.8EG 7.8
2021-05-11
Windows Container Manager Service Elevation of Privilege Vulnerability
CVE-2021-27616HIGHCVSS 7.8EG 7.8
2021-05-11
Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access informat…
CVE-2021-27613HIGHCVSS 7.8EG 7.8
2021-05-11
Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information…
CVE-2021-27086HIGHCVSS 7.8EG 7.8
2021-04-13
Windows Services and Controller App Elevation of Privilege Vulnerability
CVE-2021-28791HIGHCVSS 7.8EG 7.8
2021-03-18
The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution up…
CVE-2021-0376HIGHCVSS 7.8EG 7.8
2021-03-10
In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges neede…
CVE-2020-11282HIGHCVSS 7.8EG 7.8
2021-02-22
Improper access control when using mmap with the kgsl driver with a special offset value that can be provided to map the memstore of the GPU to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2021-26026HIGHCVSS 7.8EG 7.8
2021-01-26
PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!JPEGTransW+0x000000000000c7f4 via a crafted BMP image.
CVE-2021-26025HIGHCVSS 7.8EG 7.8
2021-01-26
PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image.
CVE-2021-0317HIGHCVSS 7.8EG 7.8
2021-01-11
In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is neede…
CVE-2018-8724HIGHCVSS 7.8EG 7.8
2021-01-11
K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe.
CVE-2018-8044HIGHCVSS 7.8EG 7.8
2021-01-11
K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K7Sentry.sys.
CVE-2020-0480HIGHCVSS 7.8EG 7.8
2020-12-15
In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing a caller to copy, move, or delete files accessible to Documents…
CVE-2020-0479HIGHCVSS 7.8EG 7.8
2020-12-15
In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a malicious app to access files available to the DocumentProvider without user permission, with n…
CVE-2020-28211HIGHCVSS 7.8EG 7.8
2020-11-19
A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger.
CVE-2020-3600HIGHCVSS 7.8EG 7.8
2020-11-06
A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker coul…
CVE-2020-9090HIGHCVSS 7.8EG 7.8
2020-10-12
FusionAccess version 6.5.1 has an improper authorization vulnerability. A command is authorized with incorrect privilege. Attackers with other privilege can execute the command to exploit this vulnerability. This may compromise normal serv…
CVE-2020-3404HIGHCVSS 7.8EG 7.8
2020-09-24
A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS) w…
CVE-2020-11855HIGHCVSS 7.8EG 7.8
2020-09-22
An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attackers on the OBR host to execute code with escalated privileges.
CVE-2019-10596HIGHCVSS 7.8EG 7.8
2020-09-08
u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrag…
CVE-2020-3473HIGHCVSS 7.8EG 7.8
2020-09-04
A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local CLI shell user to elevate privileges and gain full administrative control of the device. The vulnerability is …
CVE-2020-24716HIGHCVSS 7.8EG 7.8
2020-08-27
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
CVE-2020-7583HIGHCVSS 7.8EG 7.8
2020-08-14
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does not properly validate the users' privileges when executing some operations, whic…
CVE-2020-17448HIGHCVSS 7.8EG 7.8
2020-08-11
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
CVE-2020-0115HIGHCVSS 7.8EG 7.8
2020-06-10
In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution pri…
CVE-2020-0097HIGHCVSS 7.8EG 7.8
2020-05-14
In various methods of PackageManagerService.java, there is a possible permission bypass due to a missing condition for system apps. This could lead to local escalation of privilege with User privileges needed. User interaction is not neede…
CVE-2020-1800HIGHCVSS 7.8EG 7.8
2020-03-26
HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability. The software incorrectly restricts access to a function interface from an unauthorized actor, the attacker tricks the …
CVE-2020-0085HIGHCVSS 7.8EG 7.8
2020-03-10
In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege to activate tethering with no additional execution privileges needed. Us…
CVE-2020-0084HIGHCVSS 7.8EG 7.8
2020-03-10
In several functions of NotificationManagerService.java, there are missing permission checks. This could lead to local escalation of privilege by creating fake system notifications with no additional execution privileges needed. User inter…
CVE-2020-0036HIGHCVSS 7.8EG 7.8
2020-03-10
In hasPermissions of PermissionMonitor.java, there is a possible access to restricted permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…
CVE-2019-17190HIGHCVSS 7.8EG 7.8
2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe ch…
CVE-2019-19520HIGHCVSS 7.8EG 7.8
2019-12-05
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen.
CVE-2011-1070HIGHCVSS 7.8EG 7.8
2019-11-14
v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and potentially other consequences.
CVE-2019-12671HIGHCVSS 7.8EG 7.8
2019-09-25
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insuffici…
CVE-2019-2175HIGHCVSS 7.8EG 7.8
2019-09-05
In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect order of arguments. This could lead to local escalation of privilege with no additional execution privileges needed. Use…
CVE-2019-14817HIGHCVSS 7.8EG 7.8
2019-09-03
A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript fil…
CVE-2019-14811HIGHCVSS 7.8EG 7.8
2019-09-03
A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file c…
CVE-2019-0732HIGHCVSS 7.8EG 7.8
2019-04-09
A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Security Feature Bypass Vulnerability'.
CVE-2019-1604HIGHCVSS 7.8EG 7.8
2019-03-08
A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check o…
CVE-2019-1603HIGHCVSS 7.8EG 7.8
2019-03-08
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to escalate lower-level privileges to the administrator level. The vulnerability is due to insufficient authorization enforcement. An attacker …

Map vulnerabilities like CWE-863 to your infrastructure

EchelonGraph correlates every CVE — across CWE-863 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →