CWE-863— Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.— MITRE CWE catalog

5,214 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-863page 96 of 105

CVE-2022-0985MEDIUMCVSS 4.3EG 4.3
2022-04-29
Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
CVE-2021-28544MEDIUMCVSS 4.3EG 4.3
2022-04-12
Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected l…
CVE-2022-28777MEDIUMCVSS 4.3EG 4.3
2022-04-11
Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.
CVE-2022-1193MEDIUMCVSS 4.3EG 4.3
2022-04-11
Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain cir…
CVE-2022-1105MEDIUMCVSS 4.3EG 4.3
2022-04-04
An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines …
CVE-2022-0406MEDIUMCVSS 4.3EG 4.3
2022-04-03
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVE-2022-0390MEDIUMCVSS 4.3EG 4.3
2022-04-01
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.
CVE-2022-0373MEDIUMCVSS 4.3EG 4.3
2022-04-01
Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address
CVE-2022-1177MEDIUMCVSS 4.3EG 4.3
2022-03-30
Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
CVE-2021-39876MEDIUMCVSS 4.3EG 4.3
2022-03-28
In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.
CVE-2021-41241MEDIUMCVSS 4.3EG 4.3
2022-03-08
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolde…
CVE-2022-0442MEDIUMCVSS 4.3EG 4.3
2022-03-07
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
CVE-2021-24824MEDIUMCVSS 4.3EG 4.3
2022-03-07
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, …
CVE-2022-0164MEDIUMCVSS 4.3EG 4.3
2022-02-21
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary e…
CVE-2022-25318MEDIUMCVSS 4.3EG 4.3
2022-02-18
An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.
CVE-2021-43948MEDIUMCVSS 4.3EG 4.3
2022-02-15
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected…
CVE-2021-39943MEDIUMCVSS 4.3EG 4.3
2022-02-09
An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a use…
CVE-2022-21713MEDIUMCVSS 4.3EG 4.3
2022-02-08
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view …
CVE-2022-0334MEDIUMCVSS 4.3EG 4.3
2022-01-25
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the …
CVE-2021-24733MEDIUMCVSS 4.3EG 4.3
2022-01-24
The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected posts which they cannot view normally.
CVE-2021-44836MEDIUMCVSS 4.3EG 4.3
2022-01-18
An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the …
CVE-2022-21678MEDIUMCVSS 4.3EG 4.3
2022-01-13
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles pr…
CVE-2021-38020MEDIUMCVSS 4.3EG 4.3
2021-12-23
Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2021-45091MEDIUMCVSS 4.3EG 4.3
2021-12-21
Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.
CVE-2021-39934MEDIUMCVSS 4.3EG 4.3
2021-12-13
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.…
CVE-2021-39930MEDIUMCVSS 4.3EG 4.3
2021-12-13
Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attacker to access a user's custom project and group templates
CVE-2021-24836MEDIUMCVSS 4.3EG 4.3
2021-12-13
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
CVE-2021-24819MEDIUMCVSS 4.3EG 4.3
2021-12-13
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be al…
CVE-2021-20862MEDIUMCVSS 4.3EG 4.3
2021-12-01
Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware …
CVE-2021-4026MEDIUMCVSS 4.3EG 4.3
2021-11-30
bookstack is vulnerable to Improper Access Control
CVE-2021-24851MEDIUMCVSS 4.3EG 4.3
2021-11-17
The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protect…
CVE-2021-38977MEDIUMCVSS 4.3EG 4.3
2021-11-15
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this …
CVE-2021-42026MEDIUMCVSS 4.3EG 4.3
2021-11-09
A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly…
CVE-2021-39911MEDIUMCVSS 4.3EG 4.3
2021-11-05
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 exposes private email address of Issue and M…
CVE-2021-39904MEDIUMCVSS 4.3EG 4.3
2021-11-05
An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge R…
CVE-2021-39902MEDIUMCVSS 4.3EG 4.3
2021-11-04
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.
CVE-2021-29883MEDIUMCVSS 4.3EG 4.3
2021-10-21
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a…
CVE-2021-28661MEDIUMCVSS 4.3EG 4.3
2021-10-07
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
CVE-2021-29760MEDIUMCVSS 4.3EG 4.3
2021-10-06
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213.
CVE-2021-39883MEDIUMCVSS 4.3EG 4.3
2021-10-04
Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all pa…
CVE-2021-35202MEDIUMCVSS 4.3EG 4.3
2021-09-30
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.
CVE-2021-33981MEDIUMCVSS 4.3EG 4.3
2021-09-08
An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and im…
CVE-2021-1854MEDIUMCVSS 4.3EG 4.3
2021-09-08
A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. .
CVE-2020-15939MEDIUMCVSS 4.3EG 4.3
2021-09-06
An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL.
CVE-2021-22247MEDIUMCVSS 4.3EG 4.3
2021-08-25
Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics
CVE-2021-22251MEDIUMCVSS 4.3EG 4.3
2021-08-23
Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings
CVE-2021-25954MEDIUMCVSS 4.3EG 4.3
2021-08-09
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, t…
CVE-2021-32587MEDIUMCVSS 4.3EG 4.3
2021-08-06
An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker with restricted user profile…
CVE-2021-32002MEDIUMCVSS 4.3EG 4.3
2021-08-05
Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions …
CVE-2021-36383MEDIUMCVSS 4.3EG 4.3
2021-07-12
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The atta…

Map vulnerabilities like CWE-863 to your infrastructure

EchelonGraph correlates every CVE — across CWE-863 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →