CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6714 vulnerabilities reference this CWE, most recent first.
GHSA-4R4M-3XF7-FV59
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 21:31Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via crafted network traffic. (Chromium security severity: Low)
{
"affected": [],
"aliases": [
"CVE-2026-87463"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:02Z",
"severity": "MODERATE"
},
"details": "Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via crafted network traffic. (Chromium security severity: Low)",
"id": "GHSA-4r4m-3xf7-fv59",
"modified": "2026-09-09T21:31:35Z",
"published": "2026-09-09T03:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87463"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/517776674"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4R4W-H2XW-494X
Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-19 18:32Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
{
"affected": [],
"aliases": [
"CVE-2026-21077"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T09:17:21Z",
"severity": "MODERATE"
},
"details": "Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.",
"id": "GHSA-4r4w-h2xw-494x",
"modified": "2026-08-19T18:32:04Z",
"published": "2026-08-10T09:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21077"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2026\u0026month=08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4R5R-CCR6-Q6F6
Vulnerability from github – Published: 2026-01-20 20:55 – Updated: 2026-02-27 22:03Summary
A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.
Impact
Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.
Patches
- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3
Workarounds
If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist.
For more information
If you have any questions or comments about this advisory:
Email us at security@fleetdm.com Join #fleet in osquery Slack
Credits
We thank @secfox-ai for responsibly reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.78.0"
},
{
"fixed": "4.78.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.77.0"
},
{
"fixed": "4.77.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.76.0"
},
{
"fixed": "4.76.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.75.0"
},
{
"fixed": "4.75.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.78.3-0.20260112221730-5c030e32a3a9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23517"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-20T20:55:14Z",
"nvd_published_at": "2026-01-21T22:15:49Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.\n\n### Impact\n\nFleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.\n\n### Patches\n\n- 4.78.3\n- 4.77.1\n- 4.76.2\n- 4.75.2\n- 4.53.3\n\n### Workarounds\n\nIf an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. \n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @secfox-ai for responsibly reporting this issue.",
"id": "GHSA-4r5r-ccr6-q6f6",
"modified": "2026-02-27T22:03:20Z",
"published": "2026-01-20T20:55:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23517"
},
{
"type": "WEB",
"url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317"
},
{
"type": "PACKAGE",
"url": "https://github.com/fleetdm/fleet"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Fleet has an Access Control vulnerability in debug/pprof endpoints"
}
GHSA-4R7W-CVQP-58F8
Vulnerability from github – Published: 2022-05-05 00:00 – Updated: 2022-05-12 00:01Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
{
"affected": [],
"aliases": [
"CVE-2022-1502"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-04T07:15:00Z",
"severity": "MODERATE"
},
"details": "Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.",
"id": "GHSA-4r7w-cvqp-58f8",
"modified": "2022-05-12T00:01:23Z",
"published": "2022-05-05T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1502"
},
{
"type": "WEB",
"url": "https://advisories.octopus.com/post/2022/sa2022-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4R8M-M7VP-CJ97
Vulnerability from github – Published: 2022-07-26 00:00 – Updated: 2022-07-28 00:00WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
{
"affected": [],
"aliases": [
"CVE-2022-34570"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-25T22:15:00Z",
"severity": "HIGH"
},
"details": "WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.",
"id": "GHSA-4r8m-m7vp-cj97",
"modified": "2022-07-28T00:00:49Z",
"published": "2022-07-26T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34570"
},
{
"type": "WEB",
"url": "https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__messages.md"
},
{
"type": "WEB",
"url": "https://www.wavlink.com/en_us/product/WL-WN579X3.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RC4-8XQR-5G82
Vulnerability from github – Published: 2023-10-05 15:30 – Updated: 2024-04-04 08:19A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
{
"affected": [],
"aliases": [
"CVE-2022-3248"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-05T14:15:09Z",
"severity": "HIGH"
},
"details": "A flaw was found in OpenShift API, as admission checks do not enforce \"custom-host\" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.",
"id": "GHSA-4rc4-8xqr-5g82",
"modified": "2024-04-04T08:19:16Z",
"published": "2023-10-05T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3248"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-3248"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072188"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RV2-F267-RH4V
Vulnerability from github – Published: 2022-02-02 00:01 – Updated: 2022-03-18 00:01The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
{
"affected": [],
"aliases": [
"CVE-2021-25097"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-352",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-01T13:15:00Z",
"severity": "MODERATE"
},
"details": "The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication",
"id": "GHSA-4rv2-f267-rh4v",
"modified": "2022-03-18T00:01:34Z",
"published": "2022-02-02T00:01:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25097"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/67f5beb8-2cb0-4b43-87c7-dead9c005f9c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RV6-F2P6-RHX5
Vulnerability from github – Published: 2026-09-09 21:31 – Updated: 2026-09-09 21:31An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)
{
"affected": [],
"aliases": [
"CVE-2026-61910"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T20:18:36Z",
"severity": "LOW"
},
"details": "An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user\u0027s mailbox could change that mailbox\u0027s specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the shared mailbox, sharing more content than intended. (This is likely to be an unusual situation, made more unusual because if the target already has an non-shared mailbox with that role, role duplication suppression will prevent the update.)",
"id": "GHSA-4rv6-f2p6-rhx5",
"modified": "2026-09-09T21:31:56Z",
"published": "2026-09-09T21:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61910"
},
{
"type": "WEB",
"url": "https://cyrusimap.org"
},
{
"type": "WEB",
"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html"
},
{
"type": "WEB",
"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html"
},
{
"type": "WEB",
"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RXC-3M94-7XRJ
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 15:34Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-87481"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:04Z",
"severity": "HIGH"
},
"details": "Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-4rxc-3m94-7xrj",
"modified": "2026-09-09T15:34:57Z",
"published": "2026-09-09T03:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87481"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/498730641"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4V4H-6MHP-RWXF
Vulnerability from github – Published: 2026-08-02 06:30 – Updated: 2026-08-05 18:31The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
{
"affected": [],
"aliases": [
"CVE-2026-15939"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-02T06:16:37Z",
"severity": "LOW"
},
"details": "The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9\u0027s own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.",
"id": "GHSA-4v4h-6mhp-rwxf",
"modified": "2026-08-05T18:31:28Z",
"published": "2026-08-02T06:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15939"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/307a3033-ca65-4c3a-9a08-dd4a6f7dacea"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.