CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-76CQ-86P6-8Q56
Vulnerability from github – Published: 2023-08-29 21:30 – Updated: 2024-04-04 07:15An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application.
{
"affected": [],
"aliases": [
"CVE-2023-3253"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-29T20:15:10Z",
"severity": "MODERATE"
},
"details": "An improper authorization vulnerability exists where an authenticated, \nlow privileged remote attacker could view a list of all the users \navailable in the application.\n\n",
"id": "GHSA-76cq-86p6-8q56",
"modified": "2024-04-04T07:15:43Z",
"published": "2023-08-29T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3253"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2023-29"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76H3-5354-76W2
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2025-05-30 18:30In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more.
{
"affected": [],
"aliases": [
"CVE-2021-38616"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-07T12:15:00Z",
"severity": "HIGH"
},
"details": "In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users\u0027 profiles and much more.",
"id": "GHSA-76h3-5354-76w2",
"modified": "2025-05-30T18:30:40Z",
"published": "2022-05-24T19:13:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38616"
},
{
"type": "WEB",
"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38616"
},
{
"type": "WEB",
"url": "https://eigentech.com"
},
{
"type": "WEB",
"url": "https://excellium-services.com/cert-xlm-advisory"
},
{
"type": "WEB",
"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2021-38616"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76JC-447V-8VF8
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-06-19 15:30IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994.
{
"affected": [],
"aliases": [
"CVE-2024-38329"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T14:15:13Z",
"severity": "HIGH"
},
"details": "IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994.",
"id": "GHSA-76jc-447v-8vf8",
"modified": "2024-06-19T15:30:52Z",
"published": "2024-06-19T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38329"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/294994"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7157929"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76JH-M3C4-GXGJ
Vulnerability from github – Published: 2024-03-26 18:32 – Updated: 2024-08-06 18:30Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request.
{
"affected": [],
"aliases": [
"CVE-2024-2915"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T16:15:14Z",
"severity": "HIGH"
},
"details": "Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request.\n\n",
"id": "GHSA-76jh-m3c4-gxgj",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-26T18:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2915"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2024-0005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76MP-659P-RW65
Vulnerability from github – Published: 2021-05-18 18:36 – Updated: 2025-01-22 17:40Impact
A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.
Patches
The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0.
Workarounds
It's possible to workaround the issue by resetting the validkey property of the disabled XWiki users. This can be done by editing the user profile with object editor.
References
https://jira.xwiki.org/browse/XWIKI-17942
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira * Email us at Security mailing-list
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.6"
},
{
"fixed": "11.10.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-core"
},
"ranges": [
{
"events": [
{
"introduced": "12.0"
},
{
"fixed": "12.6.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-core"
},
"ranges": [
{
"events": [
{
"introduced": "12.10.0"
},
{
"fixed": "12.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-32620"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-18T16:36:02Z",
"nvd_published_at": "2021-05-28T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nA user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration. \n\n### Patches\nThe problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0.\n\n### Workarounds\nIt\u0027s possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.\n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-17942\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](http://jira.xwiki.org)\n* Email us at [Security mailing-list](mailto:security@xwiki.org)\n",
"id": "GHSA-76mp-659p-rw65",
"modified": "2025-01-22T17:40:11Z",
"published": "2021-05-18T18:36:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32620"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-commons"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-17942"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "XWiki users registered with email verification can self re-activate their disabled accounts"
}
GHSA-76MP-7869-8FCW
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2023-01-09 18:30An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to read sensitive location information.
{
"affected": [],
"aliases": [
"CVE-2020-9933"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-16T17:15:00Z",
"severity": "MODERATE"
},
"details": "An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to read sensitive location information.",
"id": "GHSA-76mp-7869-8fcw",
"modified": "2023-01-09T18:30:26Z",
"published": "2022-05-24T17:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9933"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211288"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211290"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76V4-RWR7-CGR3
Vulnerability from github – Published: 2026-04-09 00:32 – Updated: 2026-04-09 00:32GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.
{
"affected": [],
"aliases": [
"CVE-2026-2619"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T23:16:58Z",
"severity": "MODERATE"
},
"details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.",
"id": "GHSA-76v4-rwr7-cgr3",
"modified": "2026-04-09T00:32:01Z",
"published": "2026-04-09T00:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2619"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3554982"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/590430"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76WH-M9M5-CFXF
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-12 00:00The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
{
"affected": [],
"aliases": [
"CVE-2022-0825"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T16:15:00Z",
"severity": "MODERATE"
},
"details": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.",
"id": "GHSA-76wh-m9m5-cfxf",
"modified": "2022-04-12T00:00:54Z",
"published": "2022-04-05T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0825"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76X2-H8H3-CWJG
Vulnerability from github – Published: 2022-06-04 00:00 – Updated: 2022-06-15 19:43An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aleksis-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29773"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-06T21:20:39Z",
"nvd_published_at": "2022-06-03T21:15:00Z",
"severity": "MODERATE"
},
"details": "An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.",
"id": "GHSA-76x2-h8h3-cwjg",
"modified": "2022-06-15T19:43:51Z",
"published": "2022-06-04T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29773"
},
{
"type": "WEB",
"url": "https://aleksis.org/2022-05-04_advisory.html"
},
{
"type": "PACKAGE",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core"
},
{
"type": "WEB",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core/-/commit/0d39d5f566e1d916e3c8dedd3f5bd62161f30bd8"
},
{
"type": "WEB",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/688"
},
{
"type": "WEB",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Access control issue in AlekSIS-Core"
}
GHSA-7733-WH9M-X4GJ
Vulnerability from github – Published: 2023-03-22 06:30 – Updated: 2023-03-24 21:30IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.
{
"affected": [],
"aliases": [
"CVE-2023-25924"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-22T06:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.",
"id": "GHSA-7733-wh9m-x4gj",
"modified": "2023-03-24T21:30:53Z",
"published": "2023-03-22T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25924"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247630"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6962729"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.