CWE-285— Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

1,935 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-285page 24 of 39

CVE-2026-6613MEDIUMCVSS 6.3EG 6.3
2026-04-20
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to…
CVE-2026-6612MEDIUMCVSS 6.3EG 6.3
2026-04-20
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file superagi/controllers/agent_execution.py of the component Agent Execution Endpoint.…
CVE-2026-6609MEDIUMCVSS 6.3EG 6.3
2026-04-20
A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation of the argument oauthid causes improper authorization. The attack may be initiate…
CVE-2026-6586MEDIUMCVSS 6.3EG 6.3
2026-04-20
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/budget.py of the component Budget Endpoint. Such manipulation leads to authoriza…
CVE-2026-6571MEDIUMCVSS 6.3EG 6.3
2026-04-19
A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lea…
CVE-2026-5999MEDIUMCVSS 6.3EG 6.3
2026-04-10
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has b…
CVE-2026-4548MEDIUMCVSS 6.3EG 6.3
2026-03-22
A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/update-user-role.ts. The manipulation of the argument userId/role results in imprope…
CVE-2026-4171MEDIUMCVSS 6.3EG 6.3
2026-03-16
A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API …
CVE-2026-4013MEDIUMCVSS 6.3EG 6.3
2026-03-12
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php. Such manipulation leads to improper authorization. The attack may be launched re…
CVE-2026-3738MEDIUMCVSS 6.3EG 6.3
2026-03-08
A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the component Financial Report Page. The manipulation leads to improper authorization. Remote exploitation of…
CVE-2026-3737MEDIUMCVSS 6.3EG 6.3
2026-03-08
A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file add_user.php of the component User Creation Handler. Executing a manipulation can lead to improper authorizatio…
CVE-2026-2860MEDIUMCVSS 6.3EG 6.3
2026-02-21
A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to impr…
CVE-2026-2676MEDIUMCVSS 6.3EG 6.3
2026-02-18
A weakness has been identified in GoogTech sms-ssm up to e8534c766fd13f5f94c01dab475d75f286918a8d. Affected by this issue is the function preHandle of the file LoginInterceptor.java of the component API Interface. Executing a manipulation …
CVE-2025-14546MEDIUMCVSS 6.3EG 6.3
2025-12-19
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for…
CVE-2025-14089MEDIUMCVSS 6.3EG 6.3
2025-12-05
A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function update_account of the file /api/admin/update_account/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. Th…
CVE-2025-14088MEDIUMCVSS 6.3EG 6.3
2025-12-05
A vulnerability was determined in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is an unknown functionality of the file /je/load. This manipulation of the argument Authorization causes improper authorization. The attack is possib…
CVE-2025-10291MEDIUMCVSS 6.3EG 6.3
2025-09-12
A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing manipulation of the argument ID can lead to improper authorization. The attack c…
CVE-2025-10086MEDIUMCVSS 6.3EG 6.3
2025-09-08
A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component AdPositionController. This manipulation causes improper authorization. The attack…
CVE-2025-9151MEDIUMCVSS 6.3EG 6.3
2025-08-19
A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /web_config/json/name/web. Performing manipulation results in improper authorizat…
CVE-2025-8791MEDIUMCVSS 6.3EG 6.3
2025-08-10
A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/list_projects. The manipulation of the argument role leads to improper authorization.…
CVE-2025-3587MEDIUMCVSS 6.3EG 6.3
2025-04-14
A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiate…
CVE-2025-3569MEDIUMCVSS 6.3EG 6.3
2025-04-14
A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ShiroConfig.java. The manipulation leads to improper authorization. The a…
CVE-2025-1847MEDIUMCVSS 6.3EG 6.3
2025-03-03
A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been di…
CVE-2025-0849MEDIUMCVSS 6.3EG 6.3
2025-01-30
A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. I…
CVE-2020-3539MEDIUMCVSS 6.3EG 6.3
2024-11-18
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. The vulnerability is due to a f…
CVE-2024-9297MEDIUMCVSS 6.3EG 6.3
2024-09-28
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument page with…
CVE-2024-9082MEDIUMCVSS 6.3EG 6.3
2024-09-22
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The mani…
CVE-2024-7851MEDIUMCVSS 6.3EG 6.3
2024-08-16
A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Users.php?f=save of the component Add User Handler. The manipulati…
CVE-2024-43045MEDIUMCVSS 6.3EG 6.3
2024-08-07
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
CVE-2024-3013MEDIUMCVSS 6.3EG 6.3
2024-03-28
A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authori…
CVE-2021-4335MEDIUMCVSS 6.3EG 6.3
2023-10-20
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This mak…
CVE-2023-2345MEDIUMCVSS 6.3EG 6.3
2023-04-27
A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to…
CVE-2020-14486MEDIUMCVSS 6.3EG 6.3
2020-07-29
An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands.
CVE-2016-9575MEDIUMCVSS 6.3EG 6.3
2018-03-13
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw …
CVE-2026-1894MEDIUMCVSS 5.4EG 6.3
2026-02-04
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results …
CVE-2025-13114MEDIUMCVSS 5.3EG 6.3
2025-11-13
A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploi…
CVE-2026-32921MEDIUMCVSS 5.0EG 6.3
2026-03-31
OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved scri…
CVE-2026-2209MEDIUMCVSS 4.3EG 6.3
2026-02-08
A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in …
CVE-2025-15106MEDIUMCVSS 4.3EG 6.3
2025-12-27
A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper auth…
CVE-2025-13118MEDIUMCVSS 4.3EG 6.3
2025-11-13
A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can …
CVE-2024-57954MEDIUMCVSS 6.2EG 6.2
2025-02-06
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-51525MEDIUMCVSS 6.2EG 6.2
2024-11-05
Permission control vulnerability in the clipboard module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2023-29152MEDIUMCVSS 6.2EG 6.2
2023-06-07
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
CVE-2023-21440MEDIUMCVSS 6.2EG 6.2
2023-02-09
Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture.
CVE-2022-36837MEDIUMCVSS 6.2EG 6.2
2022-08-05
Intent redirection vulnerability using implicit intent in Samsung email prior to version 6.1.70.20 allows attacker to get sensitive information.
CVE-2022-33702MEDIUMCVSS 6.2EG 6.2
2022-07-12
Improper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local attacker to disable keyguard and bypass Knoxguard lock by factory reset.
CVE-2026-118173MEDIUMCVSS 6.1EG 6.1
2026-10-27
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP…
CVE-2026-70923MEDIUMCVSS 6.1EG 6.1
2026-08-18
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network acce…
CVE-2026-49446MEDIUMCVSS 6.1EG 6.1
2026-07-28
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunn…
CVE-2026-62444MEDIUMCVSS 6.1EG 6.1
2026-07-21
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attack…

Map vulnerabilities like CWE-285 to your infrastructure

EchelonGraph correlates every CVE — across CWE-285 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →