CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-5QMR-W63R-99Q4
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2026-02-20 21:31A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Browsers Security Feature Bypass Vulnerability'.
{
"affected": [],
"aliases": [
"CVE-2019-1192"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T21:15:00Z",
"severity": "MODERATE"
},
"details": "A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka \u0027Microsoft Browsers Security Feature Bypass Vulnerability\u0027.",
"id": "GHSA-5qmr-w63r-99q4",
"modified": "2026-02-20T21:31:10Z",
"published": "2022-05-24T16:53:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1192"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1192"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5QQ3-3HPQ-CRQ9
Vulnerability from github – Published: 2024-10-28 21:30 – Updated: 2026-04-02 21:32A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information.
{
"affected": [],
"aliases": [
"CVE-2024-44289"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-28T21:15:08Z",
"severity": "HIGH"
},
"details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information.",
"id": "GHSA-5qq3-3hpq-crq9",
"modified": "2026-04-02T21:32:00Z",
"published": "2024-10-28T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44289"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121564"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121568"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121570"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5QR5-M9M2-VFX5
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-07-13 00:00In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.
{
"affected": [],
"aliases": [
"CVE-2020-22784"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-28T21:15:00Z",
"severity": "HIGH"
},
"details": "In Etherpad UeberDB \u003c 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB\u0027s MySQL connector could allow bypassing access controls enforced on key names.",
"id": "GHSA-5qr5-m9m2-vfx5",
"modified": "2022-07-13T00:00:44Z",
"published": "2022-05-24T17:49:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22784"
},
{
"type": "WEB",
"url": "https://github.com/ether/ueberDB/commit/e8b58d03534ade8d83c2d1946a8350a23952531e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5R23-PRX4-MQG3
Vulnerability from github – Published: 2026-02-19 19:39 – Updated: 2026-02-20 16:46Impact
Host Policies will incorrectly permit traffic from Pods on other nodes when all of the following configurations are enabled: * Native Routing * WireGuard * Node Encryption (beta)
These options are disabled by default in Cilium.
Patches
This issue was fixed by #42892.
This issue affects:
- Cilium v1.18 between v1.18.0 and v1.18.5 inclusive
This issue is fixed in:
- Cilium v1.18.6
Workarounds
There is currently no officially verified or comprehensive workaround for this issue. The following procedure has been validated strictly within a local 'Kind' environment and has not undergone exhaustive testing across diverse production architectures. Proceed with caution.
To mitigate the identified traffic bypass, ensure all ingress traffic from the cilium_wg0 interface is explicitly routed to cilium_host for policy enforcement. This ensures that host-level security policies are applied to decrypted WireGuard traffic. Execute the following configuration on each CiliumNode:
# IPv4 Traffic
ip rule add iif cilium_wg0 table 300
ip route add default dev cilium_host table 300
# IPv6 Traffic
ip -6 rule add iif cilium_wg0 table 300
ip -6 route add default dev cilium_net table 300
Acknowledgements
Special thanks to @julianwiedmann for reporting the issue and helping with the resolution.
For more information
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 1.18.5"
},
"package": {
"ecosystem": "Go",
"name": "github.com/cilium/cilium"
},
"ranges": [
{
"events": [
{
"introduced": "1.18.0"
},
{
"fixed": "1.18.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-26963"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-19T19:39:01Z",
"nvd_published_at": "2026-02-20T00:16:16Z",
"severity": "MODERATE"
},
"details": "### Impact\n\n[Host Policies](https://docs.cilium.io/en/stable/security/policy/language/#host-policies) will incorrectly permit traffic from Pods on other nodes when all of the following configurations are enabled:\n* [Native Routing](https://docs.cilium.io/en/stable/network/concepts/routing/#native-routing)\n* [WireGuard](https://docs.cilium.io/en/stable/security/policy/language/#host-policies)\n* [Node Encryption](https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#node-to-node-encryption-beta) (beta)\n\nThese options are disabled by default in Cilium.\n\n### Patches\n\nThis issue was fixed by #42892.\n\nThis issue affects:\n\n* Cilium v1.18 between v1.18.0 and v1.18.5 inclusive\n\nThis issue is fixed in:\n\n* Cilium v1.18.6\n\n### Workarounds\n\nThere is currently no officially verified or comprehensive workaround for this issue. The following procedure has been validated strictly within a local \u0027Kind\u0027 environment and has not undergone exhaustive testing across diverse production architectures. Proceed with caution.\n\nTo mitigate the identified traffic bypass, ensure all ingress traffic from the `cilium_wg0` interface is explicitly routed to `cilium_host` for policy enforcement. This ensures that host-level security policies are applied to decrypted WireGuard traffic. Execute the following configuration on each CiliumNode:\n\n```bash\n# IPv4 Traffic\nip rule add iif cilium_wg0 table 300\nip route add default dev cilium_host table 300\n\n# IPv6 Traffic\nip -6 rule add iif cilium_wg0 table 300\nip -6 route add default dev cilium_net table 300\n```\n\n### Acknowledgements\n\nSpecial thanks to @julianwiedmann for reporting the issue and helping with the resolution.\n\n### For more information\n\nIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.",
"id": "GHSA-5r23-prx4-mqg3",
"modified": "2026-02-20T16:46:49Z",
"published": "2026-02-19T19:39:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-5r23-prx4-mqg3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26963"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/pull/42892"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/commit/88e28e1e62c0b1a02c3f0fc22d888ac9eefbe885"
},
{
"type": "PACKAGE",
"url": "https://github.com/cilium/cilium"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/releases/tag/v1.18.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled"
}
GHSA-5R29-8GXX-9WP7
Vulnerability from github – Published: 2025-05-08 00:31 – Updated: 2025-05-08 00:31On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS roles. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2025-46265"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T22:15:21Z",
"severity": "HIGH"
},
"details": "On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS roles.\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-5r29-8gxx-9wp7",
"modified": "2025-05-08T00:31:12Z",
"published": "2025-05-08T00:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46265"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000139503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5R2Q-WFPH-6XR3
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2022-05-24 17:26Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass.
{
"affected": [],
"aliases": [
"CVE-2020-9712"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-19T14:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass.",
"id": "GHSA-5r2q-wfph-6xr3",
"modified": "2022-05-24T17:26:11Z",
"published": "2022-05-24T17:26:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9712"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb20-48.html"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-990"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5R8F-96GM-5J6G
Vulnerability from github – Published: 2026-04-01 00:00 – Updated: 2026-04-01 00:00Summary
The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation.
Impact
A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.
Affected Component
src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts
Fixed Versions
- Affected:
<= 2026.3.24 - Patched:
>= 2026.3.28 - Latest stable
2026.3.28contains the fix.
Fix
Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.24"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-01T00:00:34Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nThe `chat.send` path reused command authorization to trigger `/reset` session rotation even though direct session reset is an admin-only control-plane operation.\n\n## Impact\n\nA write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.\n\n## Affected Component\n\n`src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts`\n\n## Fixed Versions\n\n- Affected: `\u003c= 2026.3.24`\n- Patched: `\u003e= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `be00fcfccb` (`Gateway: align chat.send reset scope checks`).",
"id": "GHSA-5r8f-96gm-5j6g",
"modified": "2026-04-01T00:00:34Z",
"published": "2026-04-01T00:00:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/be00fcfccba108f88dc3d4380146c6e058770b03"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.28"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`"
}
GHSA-5RFM-Q8CG-PQ99
Vulnerability from github – Published: 2023-01-03 00:30 – Updated: 2023-01-09 21:30The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
{
"affected": [],
"aliases": [
"CVE-2022-3911"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-352",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-02T22:15:00Z",
"severity": "HIGH"
},
"details": "The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc",
"id": "GHSA-5rfm-q8cg-pq99",
"modified": "2023-01-09T21:30:22Z",
"published": "2023-01-03T00:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3911"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5RJF-VJ5J-H95F
Vulnerability from github – Published: 2023-05-10 15:30 – Updated: 2024-04-04 03:59Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to potentially enable denial of service via local access.
{
"affected": [],
"aliases": [
"CVE-2022-41610"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-10T14:15:16Z",
"severity": "MODERATE"
},
"details": "Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to potentially enable denial of service via local access.",
"id": "GHSA-5rjf-vj5j-h95f",
"modified": "2024-04-04T03:59:34Z",
"published": "2023-05-10T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41610"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00808.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5RM5-XP9H-JF8Q
Vulnerability from github – Published: 2021-12-31 00:00 – Updated: 2022-01-08 00:00Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default.
{
"affected": [],
"aliases": [
"CVE-2021-20149"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-30T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default.",
"id": "GHSA-5rm5-xp9h-jf8q",
"modified": "2022-01-08T00:00:40Z",
"published": "2021-12-31T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20149"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2021-54"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.