CWE-863
CVEs classified under CWE-863, newest first.
1561 CVEsRSS
CVE-2026-119115High· 8.5Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificate…
CVE-2026-63414HighShopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
CVE-2026-118685Medium· 6.5ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attacke…
CVE-2026-118676High· 7.1n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-exe…
CVE-2026-118675High· 7.1n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the…
CVE-2026-118642High· 7.1n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowin…
CVE-2026-118640Medium· 5.4n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the global:chatUser role can add and run tools through chat to e…
CVE-2026-118668High· 8.6LangGraph JavaScript custom authentication may permit cross-user Store access
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried acros…
CVE-2026-118650High· 7.5Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
CVE-2026-100105High· 7.7Alerting contact point authorization bypass via schema downgrade
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored creden…
CVE-2026-111032Low· 3.8Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any a…
CVE-2026-111960Medium· 4.3Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public e…
CVE-2026-116575Medium· 6.3Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
CVE-2026-57200High· 7.5Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST …
CVE-2026-116684Medium· 6.8Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
CVE-2026-116679Medium· 5.4Neko: Authorization bypass in legacy WebRTC input handling
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input be…
CVE-2026-108302Medium· 4.3Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-105780Critical· 9.9Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute …
CVE-2026-106077High· 8.3A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
CVE-2026-104189High· 7.53Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share
The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who…
CVE-2026-117472Medium· 4.3URL prefix handling permits API key read-scope bypass in Psono Server
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was …
CVE-2026-116623High· 7.3code-projects Simple Content Management System Admin welcome.php authorization
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in …
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-110720Critical· 9.9Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed i…
CVE-2026-102649Critical· 9.9Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set i…
CVE-2026-93846Low· 3.8Team admin can escalate a team member's permissions via the team member roles endpoint
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission sc…
CVE-2026-93847Low· 3.5Improper post type validation on scheduled post endpoints
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events vi…
CVE-2026-116107Medium· 5.4Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulatio…
CVE-2026-111980Medium· 5.5GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including admi…
CVE-2026-116136Medium· 5.9ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an inter…