CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-788X-6X75-28FC
Vulnerability from github – Published: 2022-04-21 01:57 – Updated: 2022-04-21 01:57Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
{
"affected": [],
"aliases": [
"CVE-2010-1435"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-21T23:15:00Z",
"severity": "CRITICAL"
},
"details": "Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.",
"id": "GHSA-788x-6x75-28fc",
"modified": "2022-04-21T01:57:55Z",
"published": "2022-04-21T01:57:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1435"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/308-20100423-core-password-reset-tokens.html"
},
{
"type": "WEB",
"url": "https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-security-bypass-1-5-0-1-5-15"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7892-J586-2Q4M
Vulnerability from github – Published: 2025-05-01 15:31 – Updated: 2025-05-01 15:31NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
{
"affected": [],
"aliases": [
"CVE-2025-23244"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T14:15:36Z",
"severity": "HIGH"
},
"details": "NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.",
"id": "GHSA-7892-j586-2q4m",
"modified": "2025-05-01T15:31:43Z",
"published": "2025-05-01T15:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23244"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5630"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78HG-6JFM-9V5W
Vulnerability from github – Published: 2024-10-15 21:30 – Updated: 2025-11-04 00:31Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
{
"affected": [],
"aliases": [
"CVE-2024-21262"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-15T20:15:17Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).",
"id": "GHSA-78hg-6jfm-9v5w",
"modified": "2025-11-04T00:31:35Z",
"published": "2024-10-15T21:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21262"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241025-0005"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-78RC-HMP8-P646
Vulnerability from github – Published: 2021-12-09 00:00 – Updated: 2021-12-11 00:01An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.
{
"affected": [],
"aliases": [
"CVE-2021-41013"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-08T17:15:00Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log \u0026 Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.",
"id": "GHSA-78rc-hmp8-p646",
"modified": "2021-12-11T00:01:09Z",
"published": "2021-12-09T00:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41013"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-138"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-78RR-8W79-72QW
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-07-15 00:00Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory reset using dbus signal.
{
"affected": [],
"aliases": [
"CVE-2021-25433"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-08T14:15:00Z",
"severity": "MODERATE"
},
"details": "Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory reset using dbus signal.",
"id": "GHSA-78rr-8w79-72qw",
"modified": "2022-07-15T00:00:18Z",
"published": "2022-05-24T19:07:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25433"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2021\u0026month=7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-792Q-QW95-F446
Vulnerability from github – Published: 2026-03-03 23:11 – Updated: 2026-03-30 13:36Summary
In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.24(latest published at patch time) - Fixed:
2026.2.25
Details
In the affected flow (src/signal/monitor/event-handler.ts), reaction-only handling could return after enqueueSystemEvent(...) before DM/group authorization checks were evaluated for that sender.
This behavior was limited to reaction-only inbound events with reaction notifications enabled. In that case, a sender not authorized for normal DM flow could still queue a Signal reaction status line for that session.
The fix applies shared DM/group access checks before reaction notification enqueue. Pairing behavior for normal DM messages is unchanged.
Impact
- Limited to Signal reaction-only inbound events.
- Could add an unauthorized reaction status line to agent context for affected sessions.
- Did not directly enable normal DM delivery or direct host command execution.
Fix Commit(s)
2aa7842adeedef423be7ce283a9144b9f1a0a669
Release Process Note
patched_versions is pre-set to 2026.2.25 so once npm release is out, advisory publish can proceed directly.
OpenClaw thanks @tdjackey for reporting.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.2.24"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32050"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-03T23:11:47Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nIn a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.24` (latest published at patch time)\n- Fixed: `2026.2.25` \n\n### Details\nIn the affected flow (`src/signal/monitor/event-handler.ts`), reaction-only handling could return after `enqueueSystemEvent(...)` before DM/group authorization checks were evaluated for that sender.\n\nThis behavior was limited to reaction-only inbound events with reaction notifications enabled. In that case, a sender not authorized for normal DM flow could still queue a Signal reaction status line for that session.\n\nThe fix applies shared DM/group access checks before reaction notification enqueue. Pairing behavior for normal DM messages is unchanged.\n\n### Impact\n- Limited to Signal reaction-only inbound events.\n- Could add an unauthorized reaction status line to agent context for affected sessions.\n- Did not directly enable normal DM delivery or direct host command execution.\n\n### Fix Commit(s)\n- `2aa7842adeedef423be7ce283a9144b9f1a0a669`\n\n### Release Process Note\n`patched_versions` is pre-set to `2026.2.25` so once npm release is out, advisory publish can proceed directly.\n\nOpenClaw thanks @tdjackey for reporting.",
"id": "GHSA-792q-qw95-f446",
"modified": "2026-03-30T13:36:18Z",
"published": "2026-03-03T23:11:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-792q-qw95-f446"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32050"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/2aa7842adeedef423be7ce283a9144b9f1a0a669"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-unauthorized-reaction-status-event-enqueue-via-access-check-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw\u0027s Signal reaction-only status events could, in limited cases, be enqueued before access checks"
}
GHSA-793H-6F7R-6QVM
Vulnerability from github – Published: 2021-08-13 15:21 – Updated: 2023-09-26 13:12In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.druid:druid-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26920"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-06T15:02:28Z",
"nvd_published_at": "2021-07-02T08:15:00Z",
"severity": "MODERATE"
},
"details": "In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.",
"id": "GHSA-793h-6f7r-6qvm",
"modified": "2023-09-26T13:12:16Z",
"published": "2021-08-13T15:21:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26920"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d@%3Cdev.druid.apache.org%3E"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/07/02/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/09/24/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Druid ingestion system Authenticated users can read data from other sources than intended"
}
GHSA-794M-W426-MG5P
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.
{
"affected": [],
"aliases": [
"CVE-2021-3577"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-12T22:15:00Z",
"severity": "HIGH"
},
"details": "An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.",
"id": "GHSA-794m-w426-mg5p",
"modified": "2022-05-24T19:20:30Z",
"published": "2022-05-24T19:20:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3577"
},
{
"type": "WEB",
"url": "https://binatoneglobal.com/security-advisory"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-798Q-FW67-PC42
Vulnerability from github – Published: 2026-05-11 21:31 – Updated: 2026-05-12 15:31An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.
{
"affected": [],
"aliases": [
"CVE-2026-28951"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-11T21:18:56Z",
"severity": "HIGH"
},
"details": "An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.",
"id": "GHSA-798q-fw67-pc42",
"modified": "2026-05-12T15:31:33Z",
"published": "2026-05-11T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28951"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127110"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127111"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127115"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127116"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/127117"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-79M3-Q3WH-C3QM
Vulnerability from github – Published: 2022-05-17 00:01 – Updated: 2023-08-25 21:40Improper Access Control in GitHub repository publify/publify prior to 9.2.8. Anonymous users can't view but can leave comments on an article in draft mode.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "publify_core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0574"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-03T15:46:47Z",
"nvd_published_at": "2022-05-16T15:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Access Control in GitHub repository publify/publify prior to 9.2.8. Anonymous users can\u0027t view but can leave comments on an article in draft mode.",
"id": "GHSA-79m3-q3wh-c3qm",
"modified": "2023-08-25T21:40:46Z",
"published": "2022-05-17T00:01:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0574"
},
{
"type": "WEB",
"url": "https://github.com/publify/publify/commit/0e6c66ac2002136517662399bca9d838c80d9739"
},
{
"type": "PACKAGE",
"url": "https://github.com/publify/publify"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/publify_core/CVE-2022-0574.yml"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/6f322c84-9e20-4df6-97e8-92bc271ede3f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Publify Incorrect Authorization"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.