CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5657 vulnerabilities reference this CWE, most recent first.
GHSA-8VHC-HWHC-CPJ4
Vulnerability from github – Published: 2023-06-06 01:59 – Updated: 2023-12-12 19:44Impact
A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don't have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to project-specific resources (such as project secrets). In addition, resources in the namespace will now count toward the quota limit of the new project, potentially causing availability issues.
User with roles Project Owner and Project Member on the source project can exploit this vulnerability; however, this would also apply to custom roles with similar privileges.
The patched version include an improved RBAC mechanism, which checks if the user has the correct permissions before the namespace move takes place.
Patches
Patched versions include releases 2.6.13, 2.7.4 and later versions.
Workarounds
There is no direct mitigation besides updating Rancher to a patched version.
For more information
If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries.
- Open an issue in the Rancher repository.
- Verify with our support matrix and product support lifecycle.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-10676"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-06T01:59:31Z",
"nvd_published_at": "2023-12-12T17:15:07Z",
"severity": "HIGH"
},
"details": "### Impact\nA vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don\u0027t have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to project-specific resources (such as [project secrets](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets#creating-secrets-in-projects)). In addition, resources in the namespace will now count toward the [quota limit](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/about-project-resource-quotas) of the new project, potentially causing availability issues.\n\nUser with roles `Project Owner` and `Project Member` on the source project can exploit this vulnerability; however, this would also apply to custom roles with similar privileges. \n\nThe patched version include an improved RBAC mechanism, which checks if the user has the correct permissions before the namespace move takes place.\n\n### Patches\nPatched versions include releases `2.6.13`, `2.7.4` and later versions.\n\n### Workarounds\nThere is no direct mitigation besides updating Rancher to a patched version.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
"id": "GHSA-8vhc-hwhc-cpj4",
"modified": "2023-12-12T19:44:59Z",
"published": "2023-06-06T01:59:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-8vhc-hwhc-cpj4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10676"
},
{
"type": "WEB",
"url": "https://forums.rancher.com/c/announcements"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8vhc-hwhc-cpj4"
},
{
"type": "PACKAGE",
"url": "https://github.com/rancher/rancher"
},
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/releases/tag/v2.6.13"
},
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/releases/tag/v2.7.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Rancher users retain access after moving namespaces into projects they don\u0027t have access to"
}
GHSA-8VHQ-VF79-3Q7C
Vulnerability from github – Published: 2024-08-21 18:31 – Updated: 2024-08-21 18:31Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability.
The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of the user's license expiration date. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25029.
{
"affected": [],
"aliases": [
"CVE-2024-7604"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T16:15:10Z",
"severity": "MODERATE"
},
"details": "Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of the user\u0027s license expiration date. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25029.",
"id": "GHSA-8vhq-vf79-3q7c",
"modified": "2024-08-21T18:31:27Z",
"published": "2024-08-21T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7604"
},
{
"type": "WEB",
"url": "https://support.logsign.net/hc/en-us/articles/20617133769362-06-08-2024-Version-6-4-23-Release-Notes"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1104"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8VJ4-48P6-Q87M
Vulnerability from github – Published: 2026-06-25 06:30 – Updated: 2026-06-25 06:30GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks.
{
"affected": [],
"aliases": [
"CVE-2026-5952"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T05:16:55Z",
"severity": "MODERATE"
},
"details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks.",
"id": "GHSA-8vj4-48p6-q87m",
"modified": "2026-06-25T06:30:42Z",
"published": "2026-06-25T06:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5952"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3632428"
},
{
"type": "WEB",
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596134"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8VWX-CCF6-5WG2
Vulnerability from github – Published: 2026-03-26 19:05 – Updated: 2026-03-27 21:50Impact
An authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for.
Patches
This has been fixed in 5.73.16 and 6.7.2.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "statamic/cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.73.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "statamic/cms"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0-alpha.1"
},
{
"fixed": "6.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33884"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-26T19:05:46Z",
"nvd_published_at": "2026-03-27T21:17:25Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for.\n\n### Patches\nThis has been fixed in 5.73.16 and 6.7.2.",
"id": "GHSA-8vwx-ccf6-5wg2",
"modified": "2026-03-27T21:50:07Z",
"published": "2026-03-26T19:05:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/statamic/cms/security/advisories/GHSA-8vwx-ccf6-5wg2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33884"
},
{
"type": "PACKAGE",
"url": "https://github.com/statamic/cms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Statamic\u0027s live preview token bypasses content protection for unrelated entries"
}
GHSA-8VXJ-4CPH-C596
Vulnerability from github – Published: 2025-06-04 21:22 – Updated: 2025-12-31 21:58Summary
It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement.
PoC
// poc.js
import { DatabaseSync } from "node:sqlite"
const db = new DatabaseSync(":memory:");
db.exec("ATTACH DATABASE 'test.db' as test;");
db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);");
$ deno poc.js
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "deno_node"
},
"ranges": [
{
"events": [
{
"introduced": "0.129.0"
},
{
"fixed": "0.134.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48935"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-04T21:22:27Z",
"nvd_published_at": "2025-06-04T20:15:24Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nIt is possible to bypass Deno\u0027s read/write permission checks by using `ATTACH DATABASE` statement.\n\n## PoC\n\n```js\n// poc.js\nimport { DatabaseSync } from \"node:sqlite\"\n\nconst db = new DatabaseSync(\":memory:\");\ndb.exec(\"ATTACH DATABASE \u0027test.db\u0027 as test;\");\n\ndb.exec(\"CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);\");\n```\n\n```\n$ deno poc.js\n```",
"id": "GHSA-8vxj-4cph-c596",
"modified": "2025-12-31T21:58:17Z",
"published": "2025-06-04T21:22:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48935"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860"
},
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0138.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Deno has --allow-read / --allow-write permission bypass in `node:sqlite`"
}
GHSA-8W2F-H97J-QW93
Vulnerability from github – Published: 2022-10-08 00:00 – Updated: 2022-10-11 19:00An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2022-36634"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-07T20:15:00Z",
"severity": "HIGH"
},
"details": "An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.",
"id": "GHSA-8w2f-h97j-qw93",
"modified": "2022-10-11T19:00:29Z",
"published": "2022-10-08T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36634"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2022/Sep/29"
},
{
"type": "WEB",
"url": "http://zkbiosecurity.com"
},
{
"type": "WEB",
"url": "http://zkteco.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8W8F-253V-CMM2
Vulnerability from github – Published: 2023-05-31 00:31 – Updated: 2024-04-04 04:24An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled.
{
"affected": [],
"aliases": [
"CVE-2023-28352"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T00:15:10Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled.",
"id": "GHSA-8w8f-253v-cmm2",
"modified": "2024-04-04T04:24:46Z",
"published": "2023-05-31T00:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28352"
},
{
"type": "WEB",
"url": "https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight"
},
{
"type": "WEB",
"url": "https://research.nccgroup.com/?research=Technical%20advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8W9P-R848-78X9
Vulnerability from github – Published: 2026-05-12 21:31 – Updated: 2026-05-12 21:31Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
{
"affected": [],
"aliases": [
"CVE-2026-34646"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T20:16:35Z",
"severity": "HIGH"
},
"details": "Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.",
"id": "GHSA-8w9p-r848-78x9",
"modified": "2026-05-12T21:31:33Z",
"published": "2026-05-12T21:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34646"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb26-49.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8WCP-8QX6-4H6R
Vulnerability from github – Published: 2023-04-27 00:30 – Updated: 2024-04-04 03:42Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do not have appropriate access rights to generate internal reports using a direct URL.
{
"affected": [],
"aliases": [
"CVE-2023-27107"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-26T22:15:09Z",
"severity": "HIGH"
},
"details": "Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do not have appropriate access rights to generate internal reports using a direct URL.",
"id": "GHSA-8wcp-8qx6-4h6r",
"modified": "2024-04-04T03:42:25Z",
"published": "2023-04-27T00:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27107"
},
{
"type": "WEB",
"url": "https://gist.github.com/smidtbx10/f8ff1c4977b7f54886c6a52e9ef4e816"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WCW-RGGR-6844
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component.
{
"affected": [],
"aliases": [
"CVE-2020-6362"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-20T14:15:00Z",
"severity": "MODERATE"
},
"details": "SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component.",
"id": "GHSA-8wcw-rggr-6844",
"modified": "2022-05-24T17:31:52Z",
"published": "2022-05-24T17:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6362"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2953212"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.