CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5641 vulnerabilities reference this CWE, most recent first.
GHSA-9C2C-P776-G29V
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-07-13 00:01IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.
{
"affected": [],
"aliases": [
"CVE-2021-29883"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-21T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.",
"id": "GHSA-9c2c-p776-g29v",
"modified": "2022-07-13T00:01:18Z",
"published": "2022-05-24T19:18:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29883"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/207090"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6507077"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9C3H-Q3PP-FW5X
Vulnerability from github – Published: 2026-07-20 12:33 – Updated: 2026-07-20 12:33SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.
{
"affected": [],
"aliases": [
"CVE-2026-63738"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T12:19:43Z",
"severity": "MODERATE"
},
"details": "SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.",
"id": "GHSA-9c3h-q3pp-fw5x",
"modified": "2026-07-20T12:33:08Z",
"published": "2026-07-20T12:33:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-hv6h-hc26-q48p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63738"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-traversal"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9C64-9PW3-WH7P
Vulnerability from github – Published: 2024-08-22 18:31 – Updated: 2024-08-22 18:31An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.
{
"affected": [],
"aliases": [
"CVE-2024-3127"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T16:15:08Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.",
"id": "GHSA-9c64-9pw3-wh7p",
"modified": "2024-08-22T18:31:21Z",
"published": "2024-08-22T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3127"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2395169"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/452640"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9C83-CG8H-X7RP
Vulnerability from github – Published: 2024-12-17 00:31 – Updated: 2024-12-17 15:31Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check.
{
"affected": [],
"aliases": [
"CVE-2024-37775"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-16T22:15:06Z",
"severity": "HIGH"
},
"details": "Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check.",
"id": "GHSA-9c83-cg8h-x7rp",
"modified": "2024-12-17T15:31:43Z",
"published": "2024-12-17T00:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37775"
},
{
"type": "WEB",
"url": "https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf"
},
{
"type": "WEB",
"url": "http://dctrack.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CGP-F46X-4WGF
Vulnerability from github – Published: 2026-06-12 21:31 – Updated: 2026-06-12 21:31An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization, but did not exclude accounts assigned a site administrator role from recipient queries. As a result, an organization administrator could perform privileged account-management actions, such as initiating a password reset workflow, against a higher-privileged site administrator account in the same organization.
Successful exploitation may allow an authenticated organization administrator to interfere with or potentially take over a site administrator account, resulting in privilege escalation and full compromise of the MISP instance’s confidentiality, integrity, and availability.
Attack prerequisites: The attacker must be authenticated as an organization administrator in the same organization as a site administrator account.
{
"affected": [],
"aliases": [
"CVE-2026-54358"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T20:16:47Z",
"severity": "HIGH"
},
"details": "An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization, but did not exclude accounts assigned a site administrator role from recipient queries. As a result, an organization administrator could perform privileged account-management actions, such as initiating a password reset workflow, against a higher-privileged site administrator account in the same organization.\n\nSuccessful exploitation may allow an authenticated organization administrator to interfere with or potentially take over a site administrator account, resulting in privilege escalation and full compromise of the MISP instance\u2019s confidentiality, integrity, and availability.\n\nAttack prerequisites:\nThe attacker must be authenticated as an organization administrator in the same organization as a site administrator account.",
"id": "GHSA-9cgp-f46x-4wgf",
"modified": "2026-06-12T21:31:45Z",
"published": "2026-06-12T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54358"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/146795489abef478c8f595ecde2501c32482b81e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9CGR-QJC2-P73M
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-07-13 00:01Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2021-20633"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-18T01:15:00Z",
"severity": "MODERATE"
},
"details": "Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors.",
"id": "GHSA-9cgr-qjc2-p73m",
"modified": "2022-07-13T00:01:05Z",
"published": "2022-05-24T17:44:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20633"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN45797538/index.html"
},
{
"type": "WEB",
"url": "https://kb.cybozu.support/article/36869"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CHJ-JJCM-3MR7
Vulnerability from github – Published: 2023-07-01 00:30 – Updated: 2024-04-04 05:19UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both (1) running UniFi OS 3.1 and (2) hosting the UniFi Network application. "Applicable Cloud Keys" include the following: Cloud Key Gen2 and Cloud Key Gen2 Plus.
{
"affected": [],
"aliases": [
"CVE-2023-31997"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-01T00:15:10Z",
"severity": "CRITICAL"
},
"details": "UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both (1) running UniFi OS 3.1 and (2) hosting the UniFi Network application. \"Applicable Cloud Keys\" include the following: Cloud Key Gen2 and Cloud Key Gen2 Plus.\n\n",
"id": "GHSA-9chj-jjcm-3mr7",
"modified": "2024-04-04T05:19:32Z",
"published": "2023-07-01T00:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31997"
},
{
"type": "WEB",
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-032-032/e57301f4-4f5e-4d9f-90bc-71f1923ed7a4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CMP-2G73-FF98
Vulnerability from github – Published: 2023-08-07 15:30 – Updated: 2024-02-21 21:30A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.
{
"affected": [],
"aliases": [
"CVE-2023-4194"
],
"database_specific": {
"cwe_ids": [
"CWE-1188",
"CWE-843",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-07T14:15:11Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the Linux kernel\u0027s TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 (\"tun: tun_chr_open(): correctly initialize socket uid\"), - 66b2c338adce (\"tap: tap_open(): correctly initialize socket uid\"), pass \"inode-\u003ei_uid\" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.",
"id": "GHSA-9cmp-2g73-ff98",
"modified": "2024-02-21T21:30:26Z",
"published": "2023-08-07T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4194"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6583"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-4194"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2229498"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/344H6HO6SSC4KT7PDFXSDIXKMKHISSGF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TYLSJ2SAI7RF56ZLQ5CQWCJLVJSD73Q"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/20230731164237.48365-1-lersek@redhat.com"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/20230731164237.48365-2-lersek@redhat.com"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/20230731164237.48365-3-lersek@redhat.com"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231027-0002"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5480"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5492"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CR2-2MW7-2C7R
Vulnerability from github – Published: 2022-03-14 00:00 – Updated: 2022-03-20 00:00Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation.
{
"affected": [],
"aliases": [
"CVE-2022-24128"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-13T18:15:00Z",
"severity": "HIGH"
},
"details": "Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation.",
"id": "GHSA-9cr2-2mw7-2c7r",
"modified": "2022-03-20T00:00:34Z",
"published": "2022-03-14T00:00:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/timescale/timescaledb/security/advisories/GHSA-fh8v-663w-79w9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24128"
},
{
"type": "WEB",
"url": "https://github.com/timescale/timescaledb/commit/6275c2985927cfd4900b85cac5120227c8cb1f0c"
},
{
"type": "WEB",
"url": "https://github.com/timescale/timescaledb/commit/c8b8516e466c2bb7d2ae6a4b0b2e8e60b24b24a2"
},
{
"type": "WEB",
"url": "https://docs.timescale.com/timescaledb/latest/overview/release-notes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CVC-6538-66J6
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2022-05-24 17:26The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.
{
"affected": [],
"aliases": [
"CVE-2019-11862"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.",
"id": "GHSA-9cvc-6538-66j6",
"modified": "2022-05-24T17:26:17Z",
"published": "2022-05-24T17:26:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11862"
},
{
"type": "WEB",
"url": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-004"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.