CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-6RMP-2HGM-CPRX
Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2024-04-04 02:55Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
{
"affected": [],
"aliases": [
"CVE-2020-15868"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-12T22:15:00Z",
"severity": "HIGH"
},
"details": "Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.",
"id": "GHSA-6rmp-2hgm-cprx",
"modified": "2024-04-04T02:55:36Z",
"published": "2022-05-24T17:25:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15868"
},
{
"type": "WEB",
"url": "https://support.sonatype.com/hc/en-us/articles/360052192533"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6V32-FJC9-9QF6
Vulnerability from github – Published: 2026-06-15 20:36 – Updated: 2026-07-18 17:26Impact
An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.
This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.
Patches
Fixed in @nestjs/platform-fastify@11.1.24
References
Kudos goes to @a-tt-om
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.1.23"
},
"package": {
"ecosystem": "npm",
"name": "@nestjs/platform-fastify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.1.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54281"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-15T20:36:43Z",
"nvd_published_at": "2026-06-22T22:16:49Z",
"severity": "HIGH"
},
"details": "### Impact\n\nAn authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS\u0027s `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL.\n\nThis bypass works on the **default Fastify adapter configuration** \u2014 no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware.\n\n### Patches\n\nFixed in `@nestjs/platform-fastify@11.1.24`\n\n### References\n\nKudos goes to @a-tt-om",
"id": "GHSA-6v32-fjc9-9qf6",
"modified": "2026-07-18T17:26:42Z",
"published": "2026-06-15T20:36:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54281"
},
{
"type": "PACKAGE",
"url": "https://github.com/nestjs/nest"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Nest: Middleware Bypass on Fastify via Trailing Slash"
}
GHSA-6V7J-RX57-FQ3F
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-07-13 00:01A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-29144"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-29T12:15:00Z",
"severity": "MODERATE"
},
"details": "A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.",
"id": "GHSA-6v7j-rx57-fq3f",
"modified": "2022-07-13T00:01:16Z",
"published": "2022-05-24T17:49:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29144"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-009.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6V9V-7VR2-9555
Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2022-09-21 00:00Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
{
"affected": [],
"aliases": [
"CVE-2022-22091"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-16T06:15:00Z",
"severity": "HIGH"
},
"details": "Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables",
"id": "GHSA-6v9v-7vr2-9555",
"modified": "2022-09-21T00:00:52Z",
"published": "2022-09-17T00:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22091"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6VF8-8P4X-PXM5
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image.
{
"affected": [],
"aliases": [
"CVE-2021-26025"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-26T18:16:00Z",
"severity": "HIGH"
},
"details": "PlugIns\\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image.",
"id": "GHSA-6vf8-8p4x-pxm5",
"modified": "2022-05-24T17:40:21Z",
"published": "2022-05-24T17:40:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26025"
},
{
"type": "WEB",
"url": "https://github.com/secluck/pentest/blob/main/000022.md"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6VG3-HGRW-P5GF
Vulnerability from github – Published: 2026-07-01 20:12 – Updated: 2026-07-01 20:12An authenticated user could bypass permission rules that gated access on parts of a record's id — most commonly tenant-isolation rules of the form PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entries.
When a query referenced part of a composite record id (id.tenant, id.uid, …), SurrealDB read the value from the record's editable body fields instead of from the immutable id key. Because the body is editable but the id is fixed at creation, an attacker with write access could set the body field to any value and have permission checks read that spoofed value.
Impact
What an attacker can do:
- Read records hidden by permission rules of the form
id.<field> = $auth.<...>(typically tenant- or scope-isolation boundaries) by writing the same-named field on a record they control to the spoofed value. - Cause UNIQUE constraints defined on
id.<field>to silently admit duplicate entries, leaving the database with rows that violate the constraint.
What it can't do:
- Cross namespace or database isolation boundaries.
-Bypass field-level
PERMISSIONS FORupdate clauses that don't referenceid.<field>paths. - Affect availability or crash the server.
Patches
The value-path resolver now special-cases Part::Field and Part::Value against RecordIdKey::Object, reading the named component directly from the id key without ever entering select_document. The Array-keyed special case (id[0], id[1], …) is unchanged.
- Versions 3.1.0 and later are not affected.
Workarounds
Users unable to patch are advised to consider the following workarounds:
- Avoid permission expressions that read id.<field> on Object-keyed record ids; gate on the full record id (id = $auth.id) or on a server-derived session value instead.
- Avoid UNIQUE indexes on id.<field> until 3.1.0; use DEFINE INDEX ... ON FIELDS id UNIQUE (the full id) where possible.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T20:12:25Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "An authenticated user could bypass permission rules that gated access on parts of a record\u0027s id \u2014 most commonly tenant-isolation rules of the form `PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant`. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entries.\n\nWhen a query referenced part of a composite record id (`id.tenant`, `id.uid`, \u2026), SurrealDB read the value from the record\u0027s editable body fields instead of from the immutable id key. Because the body is editable but the id is fixed at creation, an attacker with write access could set the body field to any value and have permission checks read that spoofed value.\n\n### Impact\n\nWhat an attacker **can** do:\n\n- Read records hidden by permission rules of the form `id.\u003cfield\u003e = $auth.\u003c...\u003e` (typically tenant- or scope-isolation boundaries) by writing the same-named field on a record they control to the spoofed value.\n- Cause UNIQUE constraints defined on `id.\u003cfield\u003e` to silently admit duplicate entries, leaving the database with rows that violate the constraint.\n\nWhat it **can\u0027t** do:\n\n- Cross namespace or database isolation boundaries.\n-Bypass field-level `PERMISSIONS FOR` update clauses that don\u0027t reference `id.\u003cfield\u003e` paths.\n- Affect availability or crash the server.\n\n### Patches\n\nThe value-path resolver now special-cases `Part::Field` and `Part::Value` against `RecordIdKey::Object`, reading the named component directly from the id key without ever entering `select_document`. The Array-keyed special case (`id[0]`, `id[1]`, \u2026) is unchanged.\n\n- Versions 3.1.0 and later are not affected.\n\n### Workarounds\n\nUsers unable to patch are advised to consider the following workarounds:\n- Avoid permission expressions that read `id.\u003cfield\u003e` on Object-keyed record ids; gate on the full record id (`id = $auth.id`) or on a server-derived session value instead.\n- Avoid UNIQUE indexes on `id.\u003cfield\u003e` until 3.1.0; use `DEFINE INDEX ... ON FIELDS id UNIQUE` (the full id) where possible.",
"id": "GHSA-6vg3-hgrw-p5gf",
"modified": "2026-07-01T20:12:25Z",
"published": "2026-07-01T20:12:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/1fcb19040bfffba92b3f69edb9b707d469e0027b"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "SurrealDB has an Authorization Bypass via Composite Record-id Paths"
}
GHSA-6VHM-RHMC-3Q94
Vulnerability from github – Published: 2023-12-03 21:30 – Updated: 2023-12-07 15:30Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
{
"affected": [],
"aliases": [
"CVE-2023-49947"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-03T19:15:08Z",
"severity": "HIGH"
},
"details": "Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.",
"id": "GHSA-6vhm-rhmc-3q94",
"modified": "2023-12-07T15:30:37Z",
"published": "2023-12-03T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49947"
},
{
"type": "WEB",
"url": "https://codeberg.org/forgejo/forgejo/commit/44df78edd40076b349d50dc5fb02af417a44cfab"
},
{
"type": "WEB",
"url": "https://forgejo.org/2023-11-release-v1-20-5-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VP2-FHW3-WVCX
Vulnerability from github – Published: 2024-10-25 18:30 – Updated: 2024-10-29 21:30OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.
{
"affected": [],
"aliases": [
"CVE-2022-30356"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T17:15:03Z",
"severity": "HIGH"
},
"details": "OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.",
"id": "GHSA-6vp2-fhw3-wvcx",
"modified": "2024-10-29T21:30:48Z",
"published": "2024-10-25T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30356"
},
{
"type": "WEB",
"url": "https://cve.offsecguy.com/ovaledge/vulnerabilities/privilege-escalation#cve-2022-30356"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6VPQ-PCM8-6PGW
Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-06-06 00:00Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2021-21012"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-787",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-13T23:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-6vpq-pcm8-6pgw",
"modified": "2022-06-06T00:00:35Z",
"published": "2022-05-24T17:39:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21012"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/bridge/apsb21-07.html"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VPX-F5JX-6W5M
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-07-15 00:00An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.
{
"affected": [],
"aliases": [
"CVE-2021-28506"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.",
"id": "GHSA-6vpx-f5jx-6w5m",
"modified": "2022-07-15T00:00:16Z",
"published": "2022-01-15T00:01:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28506"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.