CWE-863— Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.— MITRE CWE catalog

5,171 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-863page 70 of 104

CVE-2023-29758MEDIUMCVSS 5.5EG 5.5
2023-06-09
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
CVE-2023-26818MEDIUMCVSS 5.5EG 5.5
2023-05-19
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
CVE-2023-2782MEDIUMCVSS 5.5EG 5.5
2023-05-18
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.
CVE-2023-29819MEDIUMCVSS 5.5EG 5.5
2023-05-12
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via a crafted payload.
CVE-2023-29818MEDIUMCVSS 5.5EG 5.5
2023-05-12
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to bypass protections via the default allowlist feature being stored as non-admin.
CVE-2023-27951MEDIUMCVSS 5.5EG 5.5
2023-05-08
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to bypass Gatekeeper.
CVE-2023-23538MEDIUMCVSS 5.5EG 5.5
2023-05-08
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to modify protected parts of the file system.
CVE-2023-23510MEDIUMCVSS 5.5EG 5.5
2023-02-27
A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access a user’s Safari history.
CVE-2023-23506MEDIUMCVSS 5.5EG 5.5
2023-02-27
A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access user-sensitive data.
CVE-2022-46704MEDIUMCVSS 5.5EG 5.5
2023-02-27
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to modify protected parts of the file system.
CVE-2022-45874MEDIUMCVSS 5.5EG 5.5
2022-12-28
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file.
CVE-2022-44699MEDIUMCVSS 5.5EG 5.5
2022-12-13
Azure Network Watcher Agent Security Feature Bypass Vulnerability
CVE-2022-42788MEDIUMCVSS 5.5EG 5.5
2022-11-01
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may be able to read sensitive location information.
CVE-2022-39302MEDIUMCVSS 5.5EG 5.5
2022-10-14
Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to an…
CVE-2022-38388MEDIUMCVSS 5.5EG 5.5
2022-10-11
IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access control. IBM X-Force ID: 233968.
CVE-2022-32854MEDIUMCVSS 5.5EG 5.5
2022-09-20
This issue was addressed with improved checks. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to bypass Privacy preferences.
CVE-2022-21140MEDIUMCVSS 5.5EG 5.5
2022-08-18
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable information disclosure via local access.
CVE-2022-20326MEDIUMCVSS 5.5EG 5.5
2022-08-12
In Telephony, there is a possible disclosure of SIM identifiers due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Produ…
CVE-2022-20323MEDIUMCVSS 5.5EG 5.5
2022-08-12
In PackageManager, there is a possible package installation disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
CVE-2022-26767MEDIUMCVSS 5.5EG 5.5
2022-05-26
The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy preferences.
CVE-2022-22663MEDIUMCVSS 5.5EG 5.5
2022-05-26
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-004 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.6. A malicious application may bypas…
CVE-2022-22616MEDIUMCVSS 5.5EG 5.5
2022-05-26
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVE-2021-26376MEDIUMCVSS 5.5EG 5.5
2022-05-11
Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service.
CVE-2022-28774MEDIUMCVSS 5.5EG 5.5
2022-05-11
Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.
CVE-2022-29114MEDIUMCVSS 5.5EG 5.5
2022-05-10
Windows Print Spooler Information Disclosure Vulnerability
CVE-2020-14121MEDIUMCVSS 5.5EG 5.5
2022-04-21
A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attacker can exploit the vulnerability to perform a local silent installation.
CVE-2022-23700MEDIUMCVSS 5.5EG 5.5
2022-04-04
A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVE-2021-39753MEDIUMCVSS 5.5EG 5.5
2022-03-30
In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User int…
CVE-2021-39751MEDIUMCVSS 5.5EG 5.5
2022-03-30
In Settings, there is a possible way to read Bluetooth device names without proper permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interact…
CVE-2021-39742MEDIUMCVSS 5.5EG 5.5
2022-03-30
In Voicemail, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for expl…
CVE-2022-0762MEDIUMCVSS 5.5EG 5.5
2022-02-26
Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.
CVE-2022-21157MEDIUMCVSS 5.5EG 5.5
2022-02-09
Improper access control in the Intel(R) Smart Campus Android application before version 6.1 may allow authenticated user to potentially enable information disclosure via local access.
CVE-2022-21153MEDIUMCVSS 5.5EG 5.5
2022-02-09
Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2021-39991MEDIUMCVSS 5.5EG 5.5
2022-02-09
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2021-39986MEDIUMCVSS 5.5EG 5.5
2022-02-09
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2021-37115MEDIUMCVSS 5.5EG 5.5
2022-02-09
There is an unauthorized rewriting vulnerability with the memory access management module on ACPU.Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2021-33119MEDIUMCVSS 5.5EG 5.5
2022-02-09
Improper access control in the Intel(R) RealSense(TM) DCM before version 20210625 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2021-0171MEDIUMCVSS 5.5EG 5.5
2022-02-09
Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-21899MEDIUMCVSS 5.5EG 5.5
2022-01-11
Windows Extensible Firmware Interface Security Feature Bypass Vulnerability
CVE-2021-0110MEDIUMCVSS 5.5EG 5.5
2021-11-17
Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.
CVE-2020-12954MEDIUMCVSS 5.5EG 5.5
2021-11-16
A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification.
CVE-2021-35551MEDIUMCVSS 5.5EG 5.5
2021-10-20
Vulnerability in the RDBMS Security component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network acc…
CVE-2021-0686MEDIUMCVSS 5.5EG 5.5
2021-10-06
In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different device user due to a missing permission check. This could lead to local information disclosure with no …
CVE-2021-0682MEDIUMCVSS 5.5EG 5.5
2021-10-06
In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. Use…
CVE-2021-0681MEDIUMCVSS 5.5EG 5.5
2021-10-06
In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…
CVE-2021-0680MEDIUMCVSS 5.5EG 5.5
2021-10-06
In system properties, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…
CVE-2021-0644MEDIUMCVSS 5.5EG 5.5
2021-10-06
In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with User execution privileges …
CVE-2021-30751MEDIUMCVSS 5.5EG 5.5
2021-09-08
This issue was addressed with improved data protection. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass certain Privacy preferences.
CVE-2021-22236MEDIUMCVSS 5.5EG 5.5
2021-08-25
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.
CVE-2021-30987MEDIUMCVSS 5.5EG 5.5
2021-08-24
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.1. A device may be passively tracked via BSSIDs.

Map vulnerabilities like CWE-863 to your infrastructure

EchelonGraph correlates every CVE — across CWE-863 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →