CWE-285— Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

1,935 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-285page 30 of 39

CVE-2026-23623MEDIUMCVSS 5.3EG 5.3
2026-02-06
Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to Collabora Online Development Edition version 25.04.08.2 and prior to Collabora Online versions 23.05.20.1, 24.04.17.3, and 25.04.7.5, a user …
CVE-2025-14348MEDIUMCVSS 5.3EG 5.3
2026-01-20
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's …
CVE-2025-12720MEDIUMCVSS 5.3EG 5.3
2025-12-06
The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it po…
CVE-2025-12814MEDIUMCVSS 5.3EG 5.3
2025-11-19
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it po…
CVE-2025-12777MEDIUMCVSS 5.3EG 5.3
2025-11-19
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0. This is due to the plugin not properly verifying that a user is authorized to perform actions on the RES…
CVE-2025-13115MEDIUMCVSS 5.3EG 5.3
2025-11-13
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results …
CVE-2025-11174MEDIUMCVSS 5.3EG 5.3
2025-11-01
The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table…
CVE-2025-11256MEDIUMCVSS 5.3EG 5.3
2025-10-18
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated at…
CVE-2025-10992MEDIUMCVSS 5.3EG 5.3
2025-09-26
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack ma…
CVE-2025-10977MEDIUMCVSS 5.3EG 5.3
2025-09-25
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out re…
CVE-2025-10976MEDIUMCVSS 5.3EG 5.3
2025-09-25
A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be e…
CVE-2025-10947MEDIUMCVSS 5.3EG 5.3
2025-09-25
A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing a manipulation of the argument …
CVE-2025-10759MEDIUMCVSS 5.3EG 5.3
2025-09-21
A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated re…
CVE-2025-8755MEDIUMCVSS 5.3EG 5.3
2025-08-09
A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the …
CVE-2025-8547MEDIUMCVSS 5.3EG 5.3
2025-08-05
A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation leads to improper authorization. The attack can be …
CVE-2025-53532MEDIUMCVSS 5.3EG 5.3
2025-07-07
giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of gis…
CVE-2025-6702MEDIUMCVSS 5.3EG 5.3
2025-06-26
A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The manipulation of the argument adminComment leads to improper authorization. It i…
CVE-2025-6099MEDIUMCVSS 5.3EG 5.3
2025-06-16
A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component P…
CVE-2025-3924MEDIUMCVSS 5.3EG 5.3
2025-05-07
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The plugin looks up the 'valid_email' value based solely on a supplied username par…
CVE-2025-3537MEDIUMCVSS 5.3EG 5.3
2025-04-13
A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper autho…
CVE-2025-27399MEDIUMCVSS 5.3EG 5.3
2025-02-27
Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are n…
CVE-2025-1007MEDIUMCVSS 5.3EG 5.3
2025-02-19
In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, su…
CVE-2025-1226MEDIUMCVSS 5.3EG 5.3
2025-02-12
A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated re…
CVE-2024-13821MEDIUMCVSS 5.3EG 5.3
2025-02-12
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a book…
CVE-2025-1078MEDIUMCVSS 5.3EG 5.3
2025-02-06
A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the function shouldAcceptNewConnection of the file com.apphousekitchen.aldente-pro.helper o…
CVE-2024-13109MEDIUMCVSS 5.3EG 5.3
2025-01-02
A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects some unknown processing of the file /doc.html. The manipulation leads to improper a…
CVE-2024-12901MEDIUMCVSS 5.3EG 5.3
2024-12-23
A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument passw…
CVE-2024-11768MEDIUMCVSS 5.3EG 5.3
2024-12-19
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes i…
CVE-2024-12347MEDIUMCVSS 5.3EG 5.3
2024-12-09
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Mo…
CVE-2024-11306MEDIUMCVSS 5.3EG 5.3
2024-11-18
A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processing of the file /index.php/display/database/. The manipulation leads to improper a…
CVE-2024-38370MEDIUMCVSS 5.3EG 5.3
2024-11-15
GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.
CVE-2024-10654MEDIUMCVSS 5.3EG 5.3
2024-11-01
A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the in…
CVE-2024-10598MEDIUMCVSS 5.3EG 5.3
2024-10-31
A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/attendance/leave/data.php of the component Annual Leave Handler. The manipulatio…
CVE-2020-36841MEDIUMCVSS 5.3EG 5.3
2024-10-16
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for un…
CVE-2024-45043MEDIUMCVSS 5.3EG 5.3
2024-08-28
The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. `awsfirehosereceiver` allows unauthenticated…
CVE-2024-7799MEDIUMCVSS 5.3EG 5.3
2024-08-15
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipu…
CVE-2024-6384MEDIUMCVSS 5.3EG 5.3
2024-08-13
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions…
CVE-2024-37154MEDIUMCVSS 5.3EG 5.3
2024-06-06
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Users are able to delegate tokens that have not yet been vested. This affects employees and grantees who have funds managed via `ClawbackVestingAccount`. This affects 1…
CVE-2024-0870MEDIUMCVSS 5.3EG 5.3
2024-05-14
The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4…
CVE-2024-2641MEDIUMCVSS 5.3EG 5.3
2024-03-19
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passwdManage.htm of the component Password Handler. The manipulation leads to imprope…
CVE-2024-2557MEDIUMCVSS 5.3EG 5.3
2024-03-17
A vulnerability was found in kishor-23 Food Waste Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin.php. The manipulation leads to improper authorization. The attack c…
CVE-2024-23806MEDIUMCVSS 5.3EG 5.3
2024-02-07
Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.
CVE-2023-6496MEDIUMCVSS 5.3EG 5.3
2024-01-11
The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to ob…
CVE-2023-48309MEDIUMCVSS 5.3EG 5.3
2023-11-20
NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting ho…
CVE-2023-42541MEDIUMCVSS 5.3EG 5.3
2023-11-07
Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.
CVE-2021-3784MEDIUMCVSS 5.3EG 5.3
2023-10-04
Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created use…
CVE-2023-28318MEDIUMCVSS 5.3EG 5.3
2023-05-09
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, h…
CVE-2023-28317MEDIUMCVSS 5.3EG 5.3
2023-05-09
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
CVE-2023-1167MEDIUMCVSS 5.3EG 5.3
2023-04-05
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.
CVE-2023-0734MEDIUMCVSS 5.3EG 5.3
2023-03-05
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.

Map vulnerabilities like CWE-285 to your infrastructure

EchelonGraph correlates every CVE — across CWE-285 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →