The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
3,047 vulnerabilities with CWE-863
CVE-2026-23982
MEDIUM
Apache Superset <6.0.0 - Auth Bypass
CVSS 6.5
CVE-2026-27112
CRITICAL
Kargo 1.7.0-1.7.8/1.8.11/1.9.3 - Privilege Escalation
CVSS 9.9
CVE-2026-2819
MEDIUM
Dromara RuoYi-Vue-Plus <5.5.3 - Auth Bypass
CVSS 6.3
CVE-2026-26963
MEDIUM
Cilium 1.18.0-1.18.5 - Incorrect Authorization via Native Routing with WireGuard and Node Encryption
CVSS 6.1
CVE-2026-26328
MEDIUM
OpenClaw <2026.2.14 - Privilege Escalation
CVSS 6.5
CVE-2026-26316
HIGH
OpenClaw < 2026.2.13 - Incorrect Authorization via BlueBubbles Webhook Loopback Bypass
CVSS 7.5
CVE-2026-26205
HIGH
opa-envoy-plugin <1.13.2-envoy-2 - Auth Bypass
CVE-2026-26336
HIGH
Hyland Alfresco Content Services < 25.3 - Unauthenticated Arbitrary File Read via Resource Endpoint
CVSS 7.5
CVE-2026-25232
HIGH
Gogs <=0.13.4 - Privilege Escalation
CVSS 8.8
CVE-2026-1999
MEDIUM
GitHub Enterprise Server - Auth Bypass
CVSS 6.5
CVE-2026-2386
MEDIUM
The Plus Addons for Elementor <6.4.7 - Privilege Escalation
CVSS 4.3
CVE-2026-2126
MEDIUM
User Submitted Posts Plugin - Privilege Escalation
CVSS 5.3
CVE-2026-0997
MEDIUM
Mattermost 11.1.x-11.1.2 - Privilege Escalation
CVSS 4.3
CVE-2026-22892
MEDIUM
Mattermost 10.11.0-10.11.9 11.1.0-11.1.2 11.2.0-11.2.1 - Incorrect Authorization via Jira Plugin
CVSS 4.3
CVE-2026-25767
HIGH
LavinMQ <2.6.8 - Privilege Escalation
CVSS 8.1
CVE-2026-21722
MEDIUM
Grafana 9.3.0-12.3.1 - Unauthenticated Authorization Bypass via Public Dashboard
CVSS 5.3
CVE-2026-20624
MEDIUM
macOS < 14.8.4, < 15.7.4, < 26.3 - Unprotected User Data Exposure via Injection Issue
CVSS 5.5
CVE-2026-26031
MEDIUM
Frappe Learning 2.0.0-2.43.9 - Unauthenticated Enrolled Student Email Disclosure
CVSS 5.3
CVE-2026-26012
MEDIUM
vaultwarden < 1.35.3 - Incorrect Authorization via Organization Ciphers Endpoint
CVSS 6.5
CVE-2026-25924
HIGH
kanboard < 1.2.50 - Authenticated Remote Code Execution via Plugin Installer Bypass
CVSS 8.4
CVE-2026-25890
HIGH
filebrowser < 2.57.1 - Authenticated Authorization Bypass via Multiple Slash Path Manipulation
CVSS 8.1
CVE-2026-25875
CRITICAL
PlaciPy 1.0.0 - Incorrect Authorization via JWT Claim Manipulation
CVSS 9.8
CVE-2026-25811
CRITICAL
PlaciPy 1.0.0 - Incorrect Authorization via Email Domain Tenant Identifier
CVSS 9.1
CVE-2026-2141
MEDIUM
WuKongOpenSource WukongCRM <11.3.3 - Auth Bypass
CVSS 6.3
CVE-2026-2208
MEDIUM
Wekan < 8.21 - Missing Authorization in Rules Handler
CVSS 4.3
Details
Vulnerabilities
3,047
Exploit Likelihood
High