Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6760 vulnerabilities reference this CWE, most recent first.
GHSA-76MP-659P-RW65
Vulnerability from github – Published: 2021-05-18 18:36 – Updated: 2025-01-22 17:40
VLAI
Summary
XWiki users registered with email verification can self re-activate their disabled accounts
Details
Impact
A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.
Patches
The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0.
Workarounds
It's possible to workaround the issue by resetting the validkey property of the disabled XWiki users. This can be done by editing the user profile with object editor.
References
https://jira.xwiki.org/browse/XWIKI-17942
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira * Email us at Security mailing-list
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.6"
},
{
"fixed": "11.10.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-core"
},
"ranges": [
{
"events": [
{
"introduced": "12.0"
},
{
"fixed": "12.6.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.commons:xwiki-commons-core"
},
"ranges": [
{
"events": [
{
"introduced": "12.10.0"
},
{
"fixed": "12.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-32620"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-18T16:36:02Z",
"nvd_published_at": "2021-05-28T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nA user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration. \n\n### Patches\nThe problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0.\n\n### Workarounds\nIt\u0027s possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.\n\n### References\nhttps://jira.xwiki.org/browse/XWIKI-17942\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira](http://jira.xwiki.org)\n* Email us at [Security mailing-list](mailto:security@xwiki.org)\n",
"id": "GHSA-76mp-659p-rw65",
"modified": "2025-01-22T17:40:11Z",
"published": "2021-05-18T18:36:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32620"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-commons"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-17942"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "XWiki users registered with email verification can self re-activate their disabled accounts"
}
GHSA-76MP-7869-8FCW
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2023-01-09 18:30
VLAI
Details
An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to read sensitive location information.
Severity
{
"affected": [],
"aliases": [
"CVE-2020-9933"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-16T17:15:00Z",
"severity": "MODERATE"
},
"details": "An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to read sensitive location information.",
"id": "GHSA-76mp-7869-8fcw",
"modified": "2023-01-09T18:30:26Z",
"published": "2022-05-24T17:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9933"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211288"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211290"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT211291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76V4-RWR7-CGR3
Vulnerability from github – Published: 2026-04-09 00:32 – Updated: 2026-04-09 00:32
VLAI
Details
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-2619"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T23:16:58Z",
"severity": "MODERATE"
},
"details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.",
"id": "GHSA-76v4-rwr7-cgr3",
"modified": "2026-04-09T00:32:01Z",
"published": "2026-04-09T00:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2619"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3554982"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/590430"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76WH-M9M5-CFXF
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-12 00:00
VLAI
Details
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-0825"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T16:15:00Z",
"severity": "MODERATE"
},
"details": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.",
"id": "GHSA-76wh-m9m5-cfxf",
"modified": "2022-04-12T00:00:54Z",
"published": "2022-04-05T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0825"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-76X2-H8H3-CWJG
Vulnerability from github – Published: 2022-06-04 00:00 – Updated: 2022-06-15 19:43
VLAI
Summary
Access control issue in AlekSIS-Core
Details
An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aleksis-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29773"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-06T21:20:39Z",
"nvd_published_at": "2022-06-03T21:15:00Z",
"severity": "MODERATE"
},
"details": "An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.",
"id": "GHSA-76x2-h8h3-cwjg",
"modified": "2022-06-15T19:43:51Z",
"published": "2022-06-04T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29773"
},
{
"type": "WEB",
"url": "https://aleksis.org/2022-05-04_advisory.html"
},
{
"type": "PACKAGE",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core"
},
{
"type": "WEB",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core/-/commit/0d39d5f566e1d916e3c8dedd3f5bd62161f30bd8"
},
{
"type": "WEB",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/688"
},
{
"type": "WEB",
"url": "https://edugit.org/AlekSIS/official/AlekSIS-Core/-/merge_requests/1011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Access control issue in AlekSIS-Core"
}
GHSA-7733-WH9M-X4GJ
Vulnerability from github – Published: 2023-03-22 06:30 – Updated: 2023-03-24 21:30
VLAI
Details
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-25924"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-22T06:15:00Z",
"severity": "HIGH"
},
"details": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.",
"id": "GHSA-7733-wh9m-x4gj",
"modified": "2023-03-24T21:30:53Z",
"published": "2023-03-22T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25924"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247630"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6962729"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-773F-9M23-P2HV
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-14 00:00
VLAI
Details
Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user to disable Forcepoint One Endpoint and the protection offered by it.
Severity
6.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-27609"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user to disable Forcepoint One Endpoint and the protection offered by it.",
"id": "GHSA-773f-9m23-p2hv",
"modified": "2022-04-14T00:00:40Z",
"published": "2022-04-05T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27609"
},
{
"type": "WEB",
"url": "https://help.forcepoint.com/security/CVE/CVE-2022-27609.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-773Q-QPFW-3Q8V
Vulnerability from github – Published: 2026-09-14 09:30 – Updated: 2026-09-14 09:30
VLAI
Details
An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-50460"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T07:17:15Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.",
"id": "GHSA-773q-qpfw-3q8v",
"modified": "2026-09-14T09:30:58Z",
"published": "2026-09-14T09:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50460"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2023-010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-773X-PXJG-GXGX
Vulnerability from github – Published: 2025-05-30 03:30 – Updated: 2025-06-11 21:30
VLAI
Details
An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites.
Severity
9.3 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-48757"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-30T03:15:20Z",
"severity": "CRITICAL"
},
"details": "An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites.",
"id": "GHSA-773x-pxjg-gxgx",
"modified": "2025-06-11T21:30:40Z",
"published": "2025-05-30T03:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48757"
},
{
"type": "WEB",
"url": "https://docs.lovable.dev/changelog"
},
{
"type": "WEB",
"url": "https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9"
},
{
"type": "WEB",
"url": "https://mattpalmer.io/posts/CVE-2025-48757"
},
{
"type": "WEB",
"url": "https://mattpalmer.io/posts/statement-on-CVE-2025-48757"
},
{
"type": "WEB",
"url": "https://x.com/danialasaria/status/1911862269996118272"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7754-V5C4-C9PG
Vulnerability from github – Published: 2022-05-24 17:20 – Updated: 2022-05-24 17:20
VLAI
Details
Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2020-14011"
],
"database_specific": {
"cwe_ids": [
"CWE-1188",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-15T15:15:00Z",
"severity": "HIGH"
},
"details": "Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless \"Built-in admin\" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features.",
"id": "GHSA-7754-v5c4-c9pg",
"modified": "2022-05-24T17:20:30Z",
"published": "2022-05-24T17:20:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14011"
},
{
"type": "WEB",
"url": "https://pastebin.com/EUkMx94X"
},
{
"type": "WEB",
"url": "https://www.lansweeper.com/knowledgebase/restricting-access-to-the-web-console"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/158205/Lansweeper-7.2-Default-Account-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.