CWE-285— Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

1,958 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-285page 22 of 40

CVE-2022-36872MEDIUMCVSS 5.0EG 6.5
2022-09-09
Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVE-2022-36871MEDIUMCVSS 5.0EG 6.5
2022-09-09
Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVE-2022-36870MEDIUMCVSS 5.0EG 6.5
2022-09-09
Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVE-2018-12466MEDIUMCVSS 4.4EG 6.5
2018-08-01
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
CVE-2017-9268MEDIUMCVSS 4.4EG 6.5
2018-03-01
In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of…
CVE-2024-48897MEDIUMCVSS 4.3EG 6.5
2024-11-18
A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.
CVE-2024-22021MEDIUMCVSS 4.3EG 6.5
2024-02-07
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.
CVE-2023-0609MEDIUMCVSS 4.3EG 6.5
2023-02-01
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVE-2022-3876MEDIUMCVSS 4.3EG 6.5
2022-12-19
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of…
CVE-2015-10033MEDIUMCVSS 3.5EG 6.5
2023-01-09
A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipulation leads to improper authorization. The identifier of the patch is 134f5481e…
CVE-2020-1720MEDIUMCVSS 3.1EG 6.5
2020-03-17
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, t…
CVE-2026-83805MEDIUMCVSS 6.4EG 6.4
2026-09-22
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under revi…
CVE-2026-67332MEDIUMCVSS 6.4EG 6.4
2026-08-01
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose…
CVE-2025-8532MEDIUMCVSS 6.4EG 6.4
2025-09-19
Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workfl…
CVE-2025-20264MEDIUMCVSS 6.4EG 6.4
2025-06-25
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability…
CVE-2022-31669MEDIUMCVSS 6.4EG 6.4
2024-11-14
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have ac…
CVE-2022-31667MEDIUMCVSS 6.4EG 6.4
2024-11-14
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a …
CVE-2024-3027MEDIUMCVSS 6.4EG 6.4
2024-04-13
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated at…
CVE-2024-26193MEDIUMCVSS 6.4EG 6.4
2024-04-09
Azure Migrate Remote Code Execution Vulnerability
CVE-2021-4344MEDIUMCVSS 6.4EG 6.4
2023-06-07
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling the use of user IDs that is accessible by the visitor. This makes it possible f…
CVE-2026-124574MEDIUMCVSS 6.3EG 6.3
2026-11-09
A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipula…
CVE-2026-121583MEDIUMCVSS 6.3EG 6.3
2026-11-03
A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The m…
CVE-2026-120319MEDIUMCVSS 6.3EG 6.3
2026-11-02
A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of t…
CVE-2026-116384MEDIUMCVSS 6.3EG 6.3
2026-10-26
A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vulnerability affects unknown code of the component Backend. Executing a manipulation can lead to improper authorization. The attack can be launched re…
CVE-2026-113411MEDIUMCVSS 6.3EG 6.3
2026-10-20
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improp…
CVE-2026-112043MEDIUMCVSS 6.3EG 6.3
2026-10-19
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipul…
CVE-2026-108890MEDIUMCVSS 6.3EG 6.3
2026-10-12
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Termin…
CVE-2026-108575MEDIUMCVSS 6.3EG 6.3
2026-10-11
A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authori…
CVE-2026-105171MEDIUMCVSS 6.3EG 6.3
2026-10-04
A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file …
CVE-2026-105096MEDIUMCVSS 6.3EG 6.3
2026-10-04
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypas…
CVE-2026-103233MEDIUMCVSS 6.3EG 6.3
2026-09-30
A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation o…
CVE-2026-100878MEDIUMCVSS 6.3EG 6.3
2026-09-27
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole End…
CVE-2026-97368MEDIUMCVSS 6.3EG 6.3
2026-09-24
A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the …
CVE-2026-90810MEDIUMCVSS 6.3EG 6.3
2026-09-14
A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell C…
CVE-2026-90598MEDIUMCVSS 6.3EG 6.3
2026-09-13
A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipula…
CVE-2026-90521MEDIUMCVSS 6.3EG 6.3
2026-09-13
A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulat…
CVE-2026-90520MEDIUMCVSS 6.3EG 6.3
2026-09-13
A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Int…
CVE-2026-85241MEDIUMCVSS 6.3EG 6.3
2026-09-03
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to i…
CVE-2026-83743MEDIUMCVSS 6.3EG 6.3
2026-09-01
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can…
CVE-2026-82816MEDIUMCVSS 6.3EG 6.3
2026-08-31
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. Th…
CVE-2026-82553MEDIUMCVSS 6.3EG 6.3
2026-08-30
A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqli_query of the file student_dashboard.php of the component Student Dashboard. T…
CVE-2026-78160MEDIUMCVSS 6.3EG 6.3
2026-08-24
A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorizati…
CVE-2026-78158MEDIUMCVSS 6.3EG 6.3
2026-08-24
A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack rem…
CVE-2026-78144MEDIUMCVSS 6.3EG 6.3
2026-08-23
A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipu…
CVE-2026-78142MEDIUMCVSS 6.3EG 6.3
2026-08-23
A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id …
CVE-2026-77795MEDIUMCVSS 6.3EG 6.3
2026-08-21
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpo…
CVE-2026-77036MEDIUMCVSS 6.3EG 6.3
2026-08-20
A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be lau…
CVE-2026-76999MEDIUMCVSS 6.3EG 6.3
2026-08-20
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in impro…
CVE-2024-14045MEDIUMCVSS 6.3EG 6.3
2026-08-18
A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a man…
CVE-2026-19994MEDIUMCVSS 6.3EG 6.3
2026-08-17
A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argu…

Map vulnerabilities like CWE-285 to your infrastructure

EchelonGraph correlates every CVE — across CWE-285 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →