The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
3,363 vulnerabilities with CWE-863
CVE-2026-3553
LOW
Incorrect Authorization in GitLab
CVSS 3.1
CVE-2026-49219
MEDIUM
ImageMagick: Policy Bypass can read disallowed files
CVSS 5.5
CVE-2026-53738
HIGH
Copy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling Handler
CVSS 8.1
CVE-2026-0272
HIGH
Palo Alto Networks Cloud Ngfw - Privilege Escalation
CVSS 7.2
CVE-2026-49824
HIGH
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
CVSS 8.5
CVE-2026-49823
HIGH
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook
CVSS 7.7
CVE-2026-48860
MEDIUM
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
CVSS 6.5
CVE-2026-45563
MEDIUM
Roxy-WI: IDOR — any authenticated user can read another user's full action history
CVSS 4.3
CVE-2026-45552
CRITICAL
Roxy-WI <= 8.2.6.4 - Cross-Tenant Install Authorization Bypass
CVSS 9.9
CVE-2026-45550
CRITICAL
Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body
CVSS 9.1
CVE-2026-45549
HIGH
Roxy-WI <= 8.2.6.4 - smon-agent Action Authorization Bypass
CVSS 8.5
CVE-2026-24724
HIGH
QNAP File Station 5 < 5.5.6.5243 - Incorrect Authorization
CVSS 8.1
CVE-2026-48303
CRITICAL
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
CVSS 10.0
CVE-2026-47929
HIGH
ColdFusion | Incorrect Authorization (CWE-863)
CVSS 8.4
CVE-2026-47910
MEDIUM
Dreamweaver Desktop | Incorrect Authorization (CWE-863)
CVSS 6.3
CVE-2026-45490
HIGH
Microsoft .NET - Local Privilege Escalation
CVSS 7.8
CVE-2026-41852
LOW
Spring Framework Arbitrary Method Invocation in SpEL Expressions
CVSS 3.7
CVE-2026-48507
HIGH
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
CVSS 7.1
CVE-2026-7765
MEDIUM
User Messages widget leaked issuer messages on shared dashboards
CVSS 5.3
CVE-2026-21036
MEDIUM
Samsung Internet < 30.0.0.39 - Unauthenticated Sensitive Information Exposure
CVSS 5.5
CVE-2026-21031
HIGH
Samsung Mobile Devices - Improper Authorization in AppBlock
CVSS 7.8
CVE-2026-42547
MEDIUM
IRIS Alerts Can be Falsely Attributed to Customers
CVSS 5.4
CVE-2026-41235
HIGH
Froxlor 2.3.6 FTP Shell Assignment - Authorization Bypass
CVE-2026-50266
LOW
Openstack Neutron - Incorrect Authorization
CVSS 2.2
CVE-2026-10815
MEDIUM
LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization
CVSS 6.3
Details
Vulnerabilities
3,363
Exploit Likelihood
High