CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5657 vulnerabilities reference this CWE, most recent first.
GHSA-9576-GWFX-HF32
Vulnerability from github – Published: 2023-03-03 09:30 – Updated: 2023-03-10 21:30A vulnerability was found in kylin-activation and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.11-23 and 1.30.10-5.p23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222260.
{
"affected": [],
"aliases": [
"CVE-2023-1164"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-03T07:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in kylin-activation and classified as critical. Affected by this issue is some unknown functionality of the component File Import. The manipulation leads to improper authorization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.11-23 and 1.30.10-5.p23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222260.",
"id": "GHSA-9576-gwfx-hf32",
"modified": "2023-03-10T21:30:25Z",
"published": "2023-03-03T09:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1164"
},
{
"type": "WEB",
"url": "https://github.com/i900008/vulndb/blob/main/kylin-activation_vuln.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.222260"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.222260"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-95CH-P3GW-23QG
Vulnerability from github – Published: 2023-09-06 15:30 – Updated: 2023-09-07 13:59An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-superset"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-32672"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-07T13:59:30Z",
"nvd_published_at": "2023-09-06T14:15:10Z",
"severity": "MODERATE"
},
"details": "An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.\n\n",
"id": "GHSA-95ch-p3gw-23qg",
"modified": "2023-09-07T13:59:30Z",
"published": "2023-09-06T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32672"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/superset"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Superset has incorrect authorization check"
}
GHSA-95FH-63XW-WFH3
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2025-10-22 00:32An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
{
"affected": [],
"aliases": [
"CVE-2021-40655"
],
"database_specific": {
"cwe_ids": [
"CWE-522",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-24T21:15:00Z",
"severity": "HIGH"
},
"details": "An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page",
"id": "GHSA-95fh-63xw-wfh3",
"modified": "2025-10-22T00:32:25Z",
"published": "2022-05-24T19:15:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40655"
},
{
"type": "WEB",
"url": "https://github.com/Ilovewomen/D-LINK-DIR-605"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40655"
},
{
"type": "WEB",
"url": "https://www.dlink.com/en/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-95HR-F33R-V5JC
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue.
{
"affected": [],
"aliases": [
"CVE-2021-24405"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-06T11:15:00Z",
"severity": "MODERATE"
},
"details": "The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can\u0027t register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue.",
"id": "GHSA-95hr-f33r-v5jc",
"modified": "2022-05-24T19:06:57Z",
"published": "2022-05-24T19:06:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24405"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/9157d6d2-4bda-4fcd-8192-363a63a51ff5"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/166543/WordPress-Easy-Cookie-Policy-1.6.2-Cross-Site-Scripting.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-95X7-MH78-7W2R
Vulnerability from github – Published: 2022-10-25 20:13 – Updated: 2022-10-27 18:35Overview
During our internal security assessment, it was discovered that streamed-list-objects endpoint was not validating the authorization header resulting in the disclosure of objects in the store.
Am I Affected?
You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 or prior and you are exposing the OpenFGA service to the internet.
How to fix that?
Upgrade to version v0.2.4.
Backward Compatibility
This update is backward compatible.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.2.3"
},
"package": {
"ecosystem": "Go",
"name": "github.com/openfga/openfga"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39340"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-25T20:13:38Z",
"nvd_published_at": "2022-10-25T17:15:00Z",
"severity": "MODERATE"
},
"details": "### Overview\nDuring our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store.\n\n### Am I Affected?\nYou are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet.\n\n### How to fix that?\nUpgrade to version `v0.2.4`.\n\n### Backward Compatibility\nThis update is backward compatible.",
"id": "GHSA-95x7-mh78-7w2r",
"modified": "2022-10-27T18:35:10Z",
"published": "2022-10-25T20:13:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39340"
},
{
"type": "WEB",
"url": "https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42f"
},
{
"type": "PACKAGE",
"url": "https://github.com/openfga/openfga"
},
{
"type": "WEB",
"url": "https://github.com/openfga/openfga/releases/tag/v0.2.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenFGA subject to Information Disclosure via streamed-list-objects endpoint"
}
GHSA-95XR-XPJ5-H4G4
Vulnerability from github – Published: 2023-09-06 18:30 – Updated: 2024-09-26 21:31A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.
{
"affected": [],
"aliases": [
"CVE-2023-38486"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-06T18:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the secure boot implementation on affected\u00a0Aruba 9200 and 9000 Series Controllers and Gateways allows\u00a0an attacker to bypass security controls which would normally\u00a0prohibit unsigned kernel images from executing. An attacker\u00a0can use this vulnerability to execute arbitrary runtime\u00a0operating systems, including unverified and unsigned OS\u00a0images.",
"id": "GHSA-95xr-xpj5-h4g4",
"modified": "2024-09-26T21:31:10Z",
"published": "2023-09-06T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38486"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9642-Q8FH-RW5M
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission.
{
"affected": [],
"aliases": [
"CVE-2022-27575"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "MODERATE"
},
"details": "Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission.",
"id": "GHSA-9642-q8fh-rw5m",
"modified": "2022-04-19T00:01:14Z",
"published": "2022-04-12T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27575"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-965R-9CG9-G42P
Vulnerability from github – Published: 2025-05-28 14:38 – Updated: 2025-06-04 20:48Impact
All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users.
If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations.
Attack requirements
The following conditions have to be met in order to perform this attack:
- A user must be logged in
- No relevant application roles are required
- At least one object-type must be configured via object-management
- The scope of the attack is limited to objects that are configured via object-management.
- The value of showInDataMenu is irrelevant for this attack
Patches
This issue was patched in version 12.13.0.RELEASE.
Workarounds
It is possible to override the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:objecten-api"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0.RELEASE"
},
{
"last_affected": "11.3.3.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:object-management"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0.RELEASE"
},
{
"last_affected": "11.3.3.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:object-management"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0.RELEASE"
},
{
"fixed": "12.13.0.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:objecten-api"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0.RELEASE"
},
{
"fixed": "12.13.0.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48881"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T14:38:54Z",
"nvd_published_at": "2025-05-30T06:15:28Z",
"severity": "HIGH"
},
"details": "### Impact\nAll objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users.\n\nIf object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations.\n\n### Attack requirements\nThe following conditions have to be met in order to perform this attack:\n- A user must be logged in\n - No relevant application roles are required\n- At least one object-type must be configured via object-management\n - The scope of the attack is limited to objects that are configured via object-management.\n - The value of `showInDataMenu` is irrelevant for this attack\n\n### Patches\nThis issue was patched in version 12.13.0.RELEASE.\n\n### Workarounds\nIt is possible to override the endpoint security as defined in `ObjectenApiHttpSecurityConfigurer` and `ObjectManagementHttpSecurityConfigurer`. Depending on the implementation, this could result in loss of functionality.",
"id": "GHSA-965r-9cg9-g42p",
"modified": "2025-06-04T20:48:00Z",
"published": "2025-05-28T14:38:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo-backend-libraries/security/advisories/GHSA-965r-9cg9-g42p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48881"
},
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo-backend-libraries/commit/6ab04b30d3dab816bfea32d40ba50e5dd4517272"
},
{
"type": "PACKAGE",
"url": "https://github.com/valtimo-platform/valtimo-backend-libraries"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users"
}
GHSA-9662-JC44-MGQR
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-06-29 00:00An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11and below, 5.6.11and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.
{
"affected": [],
"aliases": [
"CVE-2021-32587"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T11:15:00Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11and below, 5.6.11and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.",
"id": "GHSA-9662-jc44-mgqr",
"modified": "2022-06-29T00:00:52Z",
"published": "2022-05-24T19:10:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32587"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-059"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9672-4FH3-MCFG
Vulnerability from github – Published: 2022-11-10 12:01 – Updated: 2022-11-11 12:00Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.
{
"affected": [],
"aliases": [
"CVE-2022-3413"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-10T00:15:00Z",
"severity": "MODERATE"
},
"details": "Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project\u0027s Audit Events and Developers or Maintainers to view the group\u0027s Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.",
"id": "GHSA-9672-4fh3-mcfg",
"modified": "2022-11-11T12:00:29Z",
"published": "2022-11-10T12:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3413"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/374926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.