CWE-863

3,362 vulnerabilities with CWE-863

CVE-2026-14536 HIGH

Devolutions Server 2026.2.4-2026.2.9 - Authenticated Multi-Factor Authentication Bypass via Invalid Default MFA Value

CVSS 8.8

CVE-2026-14716 MEDIUM

nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization

CVSS 6.3

CVE-2026-58424 HIGH

Gitea Open Source Git Server - Permanent Fork PR Workflow Approval Gate Bypass

CVSS 8.9

CVE-2026-28744 HIGH

Gitea Git smart HTTP bypasses repository token scopes for bearer tokens

CVSS 8.1

CVE-2026-28740 HIGH

Gitea LFS object reuse bypasses Code-unit authorization

CVSS 7.1

CVE-2026-28699 HIGH

Gitea Basic Auth bypasses OAuth2 access token scopes

CVSS 8.1

CVE-2026-27780 CRITICAL

Gitea pre-receive hook can miss branch-protection checks after scanner errors

CVSS 9.8

CVE-2026-27775 HIGH

Gitea pre-receive hook permission cache allows full repository write access

CVSS 8.8

CVE-2026-27761 MEDIUM

Gitea repository feeds bypass API token scope enforcement

CVSS 4.3

CVE-2026-26231 HIGH

Gitea maintainer-edit permissions allow unauthorized commits to readable repositories

CVSS 8.5

CVE-2026-46730 MEDIUM

Dell PowerProtect Data Domain - Incorrect Authorization

CVSS 4.2

CVE-2026-54998 HIGH

Microsoft Exchange Online Elevation of Privilege Vulnerability

CVSS 8.8

CVE-2026-8079 HIGH

Progress Flowmon < 12.5.9/13.0.11 - Authenticated Unauthorized Actions via PDF Generation

CVSS 7.3

CVE-2026-56842 HIGH

Ubiquiti INC UniFi Network Application < 10.4.57 - Incorrect Authorization

CVSS 7.5

CVE-2026-14340 MEDIUM

GitHub Enterprise Server < 3.22 - GitHub App Token Scope Bypass

CVSS 5.0

CVE-2026-53492 CRITICAL

containerd CRI checkpoint restore CDI annotation smuggling

CVSS 9.6

CVE-2026-56152 MEDIUM

Incorrect Authorization in Elastic Defend Leading to Information Disclosure

CVSS 5.3

CVE-2026-53905 HIGH

MyComplianceOffice - Unauthorized Access to Administrator ACL View in MCO

CVSS 7.1

CVE-2026-53902 MEDIUM

Mycomplianceoffice Mco < 25.3.3.1 - Privilege Escalation

CVSS 6.5

CVE-2026-7663 CRITICAL

IBM Langflow OSS 1.0.0-1.9.6 - Unauthenticated MCP Authorization Bypass

CVSS 9.1

CVE-2026-48286 CRITICAL

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

CVSS 10.0

CVE-2026-57953 MEDIUM

Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint

CVSS 5.4

CVE-2026-57951 MEDIUM

Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table

CVSS 6.5

CVE-2026-57950 HIGH

ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController

CVSS 8.1

CVE-2026-13508 MEDIUM

khoj-ai khoj Conversation Sharing api_chat.py authorization

CVSS 5.5