Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5672 vulnerabilities reference this CWE, most recent first.
GHSA-6C6P-H79F-G6P4
Vulnerability from github – Published: 2022-11-09 22:07 – Updated: 2022-11-09 22:07
VLAI
Summary
Istio may allow identity impersonation if user has localhost access
Details
Impact
User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.
Patches
1.15.3
Workarounds
No. If using 1.15.2 please upgrade to 1.15.3 or later.
References
None at this time.
For more information
If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com
Severity
7.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/istio/istio"
},
"ranges": [
{
"events": [
{
"introduced": "1.15.0-beta.0"
},
{
"fixed": "1.15.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39388"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-09T22:07:01Z",
"nvd_published_at": "2022-11-10T20:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nUser can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.\n\n### Patches\n1.15.3\n\n### Workarounds\nNo. If using 1.15.2 please upgrade to 1.15.3 or later.\n\n### References\nNone at this time.\n\n### For more information\nIf you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)\n",
"id": "GHSA-6c6p-h79f-g6p4",
"modified": "2022-11-09T22:07:01Z",
"published": "2022-11-09T22:07:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39388"
},
{
"type": "WEB",
"url": "https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32"
},
{
"type": "WEB",
"url": "https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9"
},
{
"type": "PACKAGE",
"url": "https://github.com/istio/istio"
},
{
"type": "WEB",
"url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Istio may allow identity impersonation if user has localhost access"
}
GHSA-6C8M-9R93-F9RP
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34
VLAI
Details
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-15754"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-13T22:29:00Z",
"severity": "HIGH"
},
"details": "Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.",
"id": "GHSA-6c8m-9r93-f9rp",
"modified": "2022-05-13T01:34:09Z",
"published": "2022-05-13T01:34:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15754"
},
{
"type": "WEB",
"url": "https://www.cloudfoundry.org/blog/cve-2018-15754"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106240"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6CFR-WP44-6QMV
Vulnerability from github – Published: 2026-05-21 09:32 – Updated: 2026-06-23 21:41
VLAI
Summary
Mattermost has an Incorrect Authorization issue
Details
Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0-20260304132957-9f2616376582"
},
{
"fixed": "8.0.0-20260320113102-f2b3d1c6a945"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-4055"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T21:41:20Z",
"nvd_published_at": "2026-05-21T08:16:23Z",
"severity": "MODERATE"
},
"details": "Mattermost versions 11.5.x \u003c= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629.",
"id": "GHSA-6cfr-wp44-6qmv",
"modified": "2026-06-23T21:41:20Z",
"published": "2026-05-21T09:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4055"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost has an Incorrect Authorization issue"
}
GHSA-6CG3-CJ5X-GW9F
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07
VLAI
Details
The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
{
"affected": [],
"aliases": [
"CVE-2021-26273"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T14:15:00Z",
"severity": "HIGH"
},
"details": "The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.",
"id": "GHSA-6cg3-cj5x-gw9f",
"modified": "2022-05-24T19:07:04Z",
"published": "2022-05-24T19:07:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26273"
},
{
"type": "WEB",
"url": "https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-ninjarmm"
},
{
"type": "WEB",
"url": "https://www.ninjarmm.com"
},
{
"type": "WEB",
"url": "https://www.ninjarmm.com/blog/cve-2021-26273-cve-2021-26274"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6CGG-F8V8-8RXW
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08
VLAI
Details
HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.
{
"affected": [],
"aliases": [
"CVE-2021-36230"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-20T21:15:00Z",
"severity": "HIGH"
},
"details": "HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.",
"id": "GHSA-6cgg-f8v8-8rxw",
"modified": "2022-05-24T19:08:26Z",
"published": "2022-05-24T19:08:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36230"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2021-18-terraform-enterprise-allowed-privilege-escalation-via-run-token/27070"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/terraform"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6F44-88R9-JJFP
Vulnerability from github – Published: 2024-10-25 12:31 – Updated: 2024-10-25 18:30
VLAI
Details
In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
5.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-47025"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T11:15:17Z",
"severity": "MODERATE"
},
"details": "In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-6f44-88r9-jjfp",
"modified": "2024-10-25T18:30:48Z",
"published": "2024-10-25T12:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47025"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2024-10-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6F6H-2HC4-8GJC
Vulnerability from github – Published: 2025-04-25 03:30 – Updated: 2025-04-25 03:30
VLAI
Details
In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles.
Severity
6.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-46544"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-25T03:15:19Z",
"severity": "MODERATE"
},
"details": "In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles.",
"id": "GHSA-6f6h-2hc4-8gjc",
"modified": "2025-04-25T03:30:34Z",
"published": "2025-04-25T03:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46544"
},
{
"type": "WEB",
"url": "https://deiteriy.com"
},
{
"type": "WEB",
"url": "https://gist.github.com/ArtemBrylev/a258f920a6556470951c9a483fcf194a"
},
{
"type": "WEB",
"url": "https://sherparpa.com"
},
{
"type": "WEB",
"url": "https://twitter.com/ArtyomBrylev"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6F6M-WHQX-GC66
Vulnerability from github – Published: 2024-09-03 12:30 – Updated: 2024-09-03 21:31
VLAI
Details
This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-45587"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-03T10:15:06Z",
"severity": "HIGH"
},
"details": "This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.",
"id": "GHSA-6f6m-whqx-gc66",
"modified": "2024-09-03T21:31:12Z",
"published": "2024-09-03T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45587"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2024-0281"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6F75-X745-XCPR
Vulnerability from github – Published: 2026-06-23 22:24 – Updated: 2026-06-23 22:24
VLAI
Summary
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
Details
Impact
The vulnerability allows a non-admin user holding only the granular users.edit permission to lock every admin out of the instance by editing the activated flag (which determines whether or not a user can login) and the ldap_import flag, which determines whether or not the user can request a password reset.
Patches
Patched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a
Severity
7.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48507"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T22:24:59Z",
"nvd_published_at": "2026-06-08T17:16:52Z",
"severity": "HIGH"
},
"details": "### Impact\nThe vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a",
"id": "GHSA-6f75-x745-xcpr",
"modified": "2026-06-23T22:24:59Z",
"published": "2026-06-23T22:24:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48507"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users"
}
GHSA-6FFG-MJG7-585X
Vulnerability from github – Published: 2025-03-11 15:27 – Updated: 2025-03-12 14:40
VLAI
Summary
Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
Details
Impact
An improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section.
Patches
Will be patched in 14.3.3 and 15.2.3.
Workarounds
None available.
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 15.2.2"
},
"package": {
"ecosystem": "NuGet",
"name": "Umbraco.Cms.Api.Management"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0-rc1"
},
{
"fixed": "15.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 14.3.2"
},
"package": {
"ecosystem": "NuGet",
"name": "Umbraco.Cms.Api.Management"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-27601"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-11T15:27:28Z",
"nvd_published_at": "2025-03-11T16:15:17Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section.\n\n### Patches\nWill be patched in 14.3.3 and 15.2.3.\n\n### Workarounds\nNone available.",
"id": "GHSA-6ffg-mjg7-585x",
"modified": "2025-03-12T14:40:21Z",
"published": "2025-03-11T15:27:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27601"
},
{
"type": "WEB",
"url": "https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd"
},
{
"type": "WEB",
"url": "https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c"
},
{
"type": "PACKAGE",
"url": "https://github.com/umbraco/Umbraco-CMS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.