CWE-285— Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

1,935 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-285page 23 of 39

CVE-2026-16199MEDIUMCVSS 6.3EG 6.3
2026-07-19
A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed_exec.go. Executing a manipulation can lead to improper authorization. The attac…
CVE-2026-16195MEDIUMCVSS 6.3EG 6.3
2026-07-18
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect auth…
CVE-2026-16121MEDIUMCVSS 6.3EG 6.3
2026-07-18
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation leads to improper authorization. It is possible to initiate the attack…
CVE-2026-16119MEDIUMCVSS 6.3EG 6.3
2026-07-18
A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in inc…
CVE-2026-15909MEDIUMCVSS 6.3EG 6.3
2026-07-16
A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kd_cs leads to authorization bypass. Th…
CVE-2026-15510MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made p…
CVE-2026-15509MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carr…
CVE-2026-15499MEDIUMCVSS 6.3EG 6.3
2026-07-12
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a manipulation of the ar…
CVE-2026-15473MEDIUMCVSS 6.3EG 6.3
2026-07-12
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authoriza…
CVE-2026-15376MEDIUMCVSS 6.3EG 6.3
2026-07-10
A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulation results in improper authorization. The attack can be launched remotely. The …
CVE-2026-15374MEDIUMCVSS 6.3EG 6.3
2026-07-10
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is poss…
CVE-2026-15373MEDIUMCVSS 6.3EG 6.3
2026-07-10
A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It i…
CVE-2026-15318MEDIUMCVSS 6.3EG 6.3
2026-07-10
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id ca…
CVE-2026-15191MEDIUMCVSS 6.3EG 6.3
2026-07-09
A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a m…
CVE-2026-14716MEDIUMCVSS 6.3EG 6.3
2026-07-05
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads …
CVE-2026-13512MEDIUMCVSS 6.3EG 6.3
2026-06-28
A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler…
CVE-2026-12797MEDIUMCVSS 6.3EG 6.3
2026-06-21
A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the ar…
CVE-2026-56295MEDIUMCVSS 6.3EG 6.3
2026-06-20
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails t…
CVE-2026-11619MEDIUMCVSS 6.3EG 6.3
2026-06-09
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads t…
CVE-2026-11521MEDIUMCVSS 6.3EG 6.3
2026-06-08
A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d948. This affects an unknown part of the file src/main/java/com/alien/bank/management/system/controll…
CVE-2026-11519MEDIUMCVSS 6.3EG 6.3
2026-06-08
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The mani…
CVE-2026-11476MEDIUMCVSS 6.3EG 6.3
2026-06-08
A security vulnerability has been detected in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this issue is the function edit-admin of the file controllers/AdminController.php of the component…
CVE-2026-11461MEDIUMCVSS 6.3EG 6.3
2026-06-07
A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. Such manipulation of the argument Title leads to aut…
CVE-2026-11441MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper a…
CVE-2026-11440MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes im…
CVE-2026-11439MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in i…
CVE-2026-11438MEDIUMCVSS 6.3EG 6.3
2026-06-06
A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The a…
CVE-2026-11336MEDIUMCVSS 6.3EG 6.3
2026-06-05
A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the com…
CVE-2026-10876MEDIUMCVSS 6.3EG 6.3
2026-06-04
A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of t…
CVE-2026-10693MEDIUMCVSS 6.3EG 6.3
2026-06-03
A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper author…
CVE-2026-10269MEDIUMCVSS 6.3EG 6.3
2026-06-01
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads …
CVE-2026-10212MEDIUMCVSS 6.3EG 6.3
2026-06-01
A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manipulation of the argument session_id leads to authorization bypass. It is possible…
CVE-2026-10211MEDIUMCVSS 6.3EG 6.3
2026-06-01
A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect authorization. It is possible t…
CVE-2026-9484MEDIUMCVSS 6.3EG 6.3
2026-05-25
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/removeStudentFromClassroom of the file classroom.php. Executing a manipulation of th…
CVE-2026-9483MEDIUMCVSS 6.3EG 6.3
2026-05-25
A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. Performing a manipulation of the argument student_id results in improper authorization. The attack ma…
CVE-2026-9376MEDIUMCVSS 6.3EG 6.3
2026-05-24
A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCenter Article Submission Endpoint. Executing a manipulation of the argument id/us…
CVE-2026-8786MEDIUMCVSS 6.3EG 6.3
2026-05-18
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation o…
CVE-2026-8747MEDIUMCVSS 6.3EG 6.3
2026-05-17
A weakness has been identified in Z-BlogPHP 1.7.4.3430. This affects the function CheckComment of the file zb_system/function/c_system_event.php of the component Commend Approval Handler. This manipulation causes improper authorization. Th…
CVE-2026-8743MEDIUMCVSS 6.3EG 6.3
2026-05-17
A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible t…
CVE-2026-7782MEDIUMCVSS 6.3EG 6.3
2026-05-04
A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php of the component Tenant Handler. The manipulation of the argument ID results in a…
CVE-2026-7713MEDIUMCVSS 6.3EG 6.3
2026-05-04
A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this vulnerability is the function generate_auth_token of the file cps/kobo_auth.py of the component Kobo auth-token Route. The manipulation resu…
CVE-2026-7709MEDIUMCVSS 6.3EG 6.3
2026-05-03
A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improp…
CVE-2026-7602MEDIUMCVSS 6.3EG 6.3
2026-05-02
A vulnerability was found in JeecgBoot up to 3.9.1. Affected by this vulnerability is an unknown functionality of the file /sys/fillRule/edit of the component FillRuleUtil Component. The manipulation of the argument ruleClass results in im…
CVE-2026-7510MEDIUMCVSS 6.3EG 6.3
2026-04-30
A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The…
CVE-2026-7142MEDIUMCVSS 6.3EG 6.3
2026-04-27
A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function add_or_update_script of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It…
CVE-2026-7093MEDIUMCVSS 6.3EG 6.3
2026-04-27
A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID resu…
CVE-2026-7092MEDIUMCVSS 6.3EG 6.3
2026-04-27
A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. Th…
CVE-2026-7091MEDIUMCVSS 6.3EG 6.3
2026-04-27
A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handler. This manipulation causes improper authorization. Remote exploitation of the …
CVE-2026-6634MEDIUMCVSS 6.3EG 6.3
2026-04-20
A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript …
CVE-2026-6614MEDIUMCVSS 6.3EG 6.3
2026-04-20
A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_projects_organisation of the file superagi/controllers/project.py. The manipulat…

Map vulnerabilities like CWE-285 to your infrastructure

EchelonGraph correlates every CVE — across CWE-285 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →