CWE-285— Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

1,958 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-285page 23 of 40

CVE-2026-19006MEDIUMCVSS 6.3EG 6.3
2026-08-06
A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack…
CVE-2026-18998MEDIUMCVSS 6.3EG 6.3
2026-08-06
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper autho…
CVE-2026-18997MEDIUMCVSS 6.3EG 6.3
2026-08-06
A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorre…
CVE-2026-18992MEDIUMCVSS 6.3EG 6.3
2026-08-06
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in…
CVE-2026-18818MEDIUMCVSS 6.3EG 6.3
2026-08-04
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authoriz…
CVE-2026-18773MEDIUMCVSS 6.3EG 6.3
2026-08-04
A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect a…
CVE-2026-18723MEDIUMCVSS 6.3EG 6.3
2026-08-04
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper…
CVE-2026-18722MEDIUMCVSS 6.3EG 6.3
2026-08-04
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation r…
CVE-2026-48115MEDIUMCVSS 6.3EG 6.3
2026-08-03
Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow …
CVE-2026-18631MEDIUMCVSS 6.3EG 6.3
2026-08-03
A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component Pre…
CVE-2026-17530MEDIUMCVSS 6.3EG 6.3
2026-07-27
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipula…
CVE-2026-17529MEDIUMCVSS 6.3EG 6.3
2026-07-27
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack ma…
CVE-2026-17434MEDIUMCVSS 6.3EG 6.3
2026-07-26
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. …
CVE-2026-16217MEDIUMCVSS 6.3EG 6.3
2026-07-19
A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the arg…
CVE-2026-16214MEDIUMCVSS 6.3EG 6.3
2026-07-19
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be e…
CVE-2026-16199MEDIUMCVSS 6.3EG 6.3
2026-07-19
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed_exec.go. Executing a manipulation can lead to improper authorization. The attac…
CVE-2026-16195MEDIUMCVSS 6.3EG 6.3
2026-07-18
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect auth…
CVE-2026-16121MEDIUMCVSS 6.3EG 6.3
2026-07-18
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation leads to improper authorization. It is possible to initiate the attack…
CVE-2026-16119MEDIUMCVSS 6.3EG 6.3
2026-07-18
A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in inc…
CVE-2026-15909MEDIUMCVSS 6.3EG 6.3
2026-07-16
A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kd_cs leads to authorization bypass. Th…
CVE-2026-15510MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made p…
CVE-2026-15509MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carr…
CVE-2026-15499MEDIUMCVSS 6.3EG 6.3
2026-07-12
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a manipulation of the ar…
CVE-2026-15473MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authoriza…
CVE-2026-15376MEDIUMCVSS 6.3EG 6.3
2026-07-10
A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulation results in improper authorization. The attack can be launched remotely. The …
CVE-2026-15374MEDIUMCVSS 6.3EG 6.3
2026-07-10
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is poss…
CVE-2026-15373MEDIUMCVSS 6.3EG 6.3
2026-07-10
A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It i…
CVE-2026-15318MEDIUMCVSS 6.3EG 6.3
2026-07-10
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id ca…
CVE-2026-15191MEDIUMCVSS 6.3EG 6.3
2026-07-09
A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a m…
CVE-2026-14716MEDIUMCVSS 6.3EG 6.3
2026-07-05
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads …
CVE-2026-13512MEDIUMCVSS 6.3EG 6.3
2026-06-28
A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler…
CVE-2026-12797MEDIUMCVSS 6.3EG 6.3
2026-06-21
A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the ar…
CVE-2026-56295MEDIUMCVSS 6.3EG 6.3
2026-06-20
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails t…
CVE-2026-11619MEDIUMCVSS 6.3EG 6.3
2026-06-09
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads t…
CVE-2026-11521MEDIUMCVSS 6.3EG 6.3
2026-06-08
A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controll…
CVE-2026-11519MEDIUMCVSS 6.3EG 6.3
2026-06-08
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The mani…
CVE-2026-11476MEDIUMCVSS 6.3EG 6.3
2026-06-08
A security vulnerability has been detected in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this issue is the function edit-admin of the file controllers/AdminController.php of the component…
CVE-2026-11461MEDIUMCVSS 6.3EG 6.3
2026-06-07
A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. Such manipulation of the argument Title leads to aut…
CVE-2026-11441MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper a…
CVE-2026-11440MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes im…
CVE-2026-11439MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in i…
CVE-2026-11438MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The a…
CVE-2026-11336MEDIUMCVSS 6.3EG 6.3
2026-06-05
A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the com…
CVE-2026-10876MEDIUMCVSS 6.3EG 6.3
2026-06-04
A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of t…
CVE-2026-10693MEDIUMCVSS 6.3EG 6.3
2026-06-03
A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper author…
CVE-2026-10269MEDIUMCVSS 6.3EG 6.3
2026-06-01
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads …
CVE-2026-10212MEDIUMCVSS 6.3EG 6.3
2026-06-01
A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manipulation of the argument session_id leads to authorization bypass. It is possible…
CVE-2026-10211MEDIUMCVSS 6.3EG 6.3
2026-06-01
A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect authorization. It is possible t…
CVE-2026-9484MEDIUMCVSS 6.3EG 6.3
2026-05-25
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/removeStudentFromClassroom of the file classroom.php. Executing a manipulation of th…
CVE-2026-9483MEDIUMCVSS 6.3EG 6.3
2026-05-25
A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipulation of the argument student_id results in improper authorization. The attack ma…

Map vulnerabilities like CWE-285 to your infrastructure

EchelonGraph correlates every CVE — across CWE-285 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →