CWE-863

2,832 vulnerabilities with CWE-863

CVE-2026-43504 MEDIUM

Prosody <0.12.6, 1.0.0-13.0.0 <13.0.5 - Auth Bypass

CVSS 6.5

CVE-2026-43001 HIGH

OpenStack Keystone 13-29 - Privilege Escalation

CVSS 7.9

CVE-2026-41174 MEDIUM

Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

CVE-2026-5712 HIGH

IdentityIQ Role Editor Incorrect Authorization Vulnerability

CVSS 8.0

CVE-2026-42432 HIGH

OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass

CVSS 7.8

CVE-2026-42431 HIGH

OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass

CVSS 8.1

CVE-2026-42429 HIGH

OpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication

CVSS 7.1

CVE-2026-42426 HIGH

OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope

CVSS 8.8

CVE-2026-42422 HIGH

OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function

CVSS 8.8

CVE-2026-41910 MEDIUM

OpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes

CVSS 4.3

CVE-2026-41404 HIGH

OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication

CVSS 8.8

CVE-2026-41381 MEDIUM

OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist

CVSS 5.4

CVE-2026-41379 HIGH

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config

CVSS 7.1

CVE-2026-41375 MEDIUM

OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints

CVSS 6.5

CVE-2026-41371 HIGH

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command

CVSS 8.5

CVE-2026-41367 MEDIUM

OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

CVSS 5.0

CVE-2026-41248 CRITICAL

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

CVSS 9.1

CVE-2026-41427 HIGH

Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients

CVE-2026-30368 MEDIUM

Lightspeed Classroom 5.1.2.1763770643 - Auth Bypass

CVSS 5.4

CVE-2026-25660 CRITICAL

Authentication bypass for certain API calls

CVSS 9.8

CVE-2026-23902 HIGH

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

CVSS 8.1

CVE-2026-41068 HIGH

Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

CVSS 7.7

CVE-2026-41325 HIGH

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

CVSS 8.8

CVE-2026-40099 MEDIUM

Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

CVSS 6.5

CVE-2026-41350 MEDIUM

OpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations

CVSS 4.3