Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5586 vulnerabilities reference this CWE, most recent first.
GHSA-CR6P-23CF-W9G9
Vulnerability from github – Published: 2022-07-12 22:15 – Updated: 2022-07-21 14:59
VLAI
Summary
UnsafeAccessor 1.4.0 until 1.7.0 has no security checking for UnsafeAccess.getInstance()
Details
Overview
Affected versions have no limit to using unsafe-accessor. Can be ignored if SecurityCheck.AccessLimiter not setup
Details
If UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA's standard api.
Main application can setup SecurityCheck.AccessLimiter for UA to limit accesses to UA.
Untrusted code can access UA without lmitation in affected versions even UA was loaded as a named module.
References
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.github.karlatemp:unsafe-accessor"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31139"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-12T22:15:53Z",
"nvd_published_at": "2022-07-11T19:15:00Z",
"severity": "MODERATE"
},
"details": "### Overview\n\nAffected versions have no limit to using unsafe-accessor. Can be ignored if `SecurityCheck.AccessLimiter` not setup\n\n### Details\n\nIf UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA\u0027s standard api.\nMain application can setup `SecurityCheck.AccessLimiter` for UA to limit accesses to UA.\nUntrusted code can access UA without lmitation in affected versions even UA was loaded as a named module.\n\n### References\n\n[The commit to fix](https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd)\n\n",
"id": "GHSA-cr6p-23cf-w9g9",
"modified": "2022-07-21T14:59:11Z",
"published": "2022-07-12T22:15:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31139"
},
{
"type": "WEB",
"url": "https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/Karlatemp/UnsafeAccessor"
},
{
"type": "WEB",
"url": "https://github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "UnsafeAccessor 1.4.0 until 1.7.0 has no security checking for UnsafeAccess.getInstance()"
}
GHSA-CR76-6P9F-9963
Vulnerability from github – Published: 2024-08-02 18:31 – Updated: 2024-08-07 18:30
VLAI
Details
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-38884"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T18:16:19Z",
"severity": "HIGH"
},
"details": "An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms",
"id": "GHSA-cr76-6p9f-9963",
"modified": "2024-08-07T18:30:41Z",
"published": "2024-08-02T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38884"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273368"
},
{
"type": "WEB",
"url": "http://caterease.com"
},
{
"type": "WEB",
"url": "http://horizon.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CR93-C4MW-5CQX
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46
VLAI
Details
KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.
{
"affected": [],
"aliases": [
"CVE-2021-26718"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-01T19:15:00Z",
"severity": "MODERATE"
},
"details": "KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.",
"id": "GHSA-cr93-c4mw-5cqx",
"modified": "2022-05-24T17:46:04Z",
"published": "2022-05-24T17:46:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26718"
},
{
"type": "WEB",
"url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310321"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CR9G-295J-FQ2W
Vulnerability from github – Published: 2026-06-02 00:31 – Updated: 2026-06-02 15:32
VLAI
Details
In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-32348"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-01T22:16:17Z",
"severity": "HIGH"
},
"details": "In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-cr9g-295j-fq2w",
"modified": "2026-06-02T15:32:01Z",
"published": "2026-06-02T00:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32348"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/2026/2026-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CRGC-QFCH-JGR7
Vulnerability from github – Published: 2024-04-10 18:30 – Updated: 2024-04-10 18:30
VLAI
Details
In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-1740"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T17:15:53Z",
"severity": "CRITICAL"
},
"details": "In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an \u0027Authorization\u0027 token in the browser, which does not properly invalidate upon the user\u0027s removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.",
"id": "GHSA-crgc-qfch-jgr7",
"modified": "2024-04-10T18:30:48Z",
"published": "2024-04-10T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1740"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/c1a51f71-628e-4eb5-ac35-50bf64832cfd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CRVQ-MW2W-4CFX
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2024-01-30 22:42
VLAI
Summary
Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration
Details
An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.
Severity
8.1 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.3"
},
"package": {
"ecosystem": "Maven",
"name": "com.blackducksoftware.integration:blackduck-hub"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1000197"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T22:42:35Z",
"nvd_published_at": "2018-06-05T21:29:00Z",
"severity": "HIGH"
},
"details": "An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/Read permission to read and write the Black Duck Hub plugin configuration.",
"id": "GHSA-crvq-mw2w-4cfx",
"modified": "2024-01-30T22:42:35Z",
"published": "2022-05-13T01:48:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000197"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-05-09/#SECURITY-670"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration"
}
GHSA-CRXX-35WQ-W63C
Vulnerability from github – Published: 2021-12-13 00:00 – Updated: 2022-04-01 00:01
VLAI
Details
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2021-41805"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-12T05:15:00Z",
"severity": "HIGH"
},
"details": "HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace.",
"id": "GHSA-crxx-35wq-w63c",
"modified": "2022-04-01T00:01:18Z",
"published": "2021-12-13T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41805"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211229-0007"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/consul"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CV64-6J2C-F8CG
Vulnerability from github – Published: 2026-03-06 09:31 – Updated: 2026-06-05 18:31
VLAI
Details
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-23925"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-06T09:15:56Z",
"severity": "MODERATE"
},
"details": "An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.",
"id": "GHSA-cv64-6j2c-f8cg",
"modified": "2026-06-05T18:31:31Z",
"published": "2026-03-06T09:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23925"
},
{
"type": "WEB",
"url": "https://support.zabbix.com/browse/ZBX-27567"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CV9J-78F7-W6V9
Vulnerability from github – Published: 2021-07-26 21:41 – Updated: 2021-07-28 19:21
VLAI
Summary
Incorrect Authorization in TYPO3 extension
Details
The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "localizationteam/l10nmgr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "localizationteam/l10nmgr"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.7.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "localizationteam/l10nmgr"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-25025"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-26T18:51:12Z",
"nvd_published_at": "2020-09-02T17:15:00Z",
"severity": "MODERATE"
},
"details": "The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).",
"id": "GHSA-cv9j-78f7-w6v9",
"modified": "2021-07-28T19:21:31Z",
"published": "2021-07-26T21:41:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25025"
},
{
"type": "WEB",
"url": "https://typo3.org/help/security-advisories"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2020-016"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Authorization in TYPO3 extension"
}
GHSA-CVC2-RR87-WJM5
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-07-13 00:01
VLAI
Details
The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2021-29658"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-31T17:15:00Z",
"severity": "HIGH"
},
"details": "The unofficial vscode-rufo extension before 0.0.4 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace folder.",
"id": "GHSA-cvc2-rr87-wjm5",
"modified": "2022-07-13T00:01:16Z",
"published": "2022-05-24T17:46:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29658"
},
{
"type": "WEB",
"url": "https://github.com/jnbt/vscode-rufo/commit/bc0d212436f76d12cbdab287802fa5bc743f818a"
},
{
"type": "WEB",
"url": "https://marketplace.visualstudio.com/items/jnbt.vscode-rufo/changelog"
},
{
"type": "WEB",
"url": "https://vuln.ryotak.me/advisories/8"
},
{
"type": "WEB",
"url": "https://vuln.ryotak.me/advisories/8.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.