CWE-863

3,064 vulnerabilities with CWE-863

CVE-2025-34273 MEDIUM

Nagios Log Server < 2024R2.0.3 - Incorrect Authorization for Global Dashboard Deletion

CVSS 6.5

CVE-2025-62795 HIGH

fit2cloud jumpserver < 3.10.21 - Authenticated Incorrect Authorization via LDAP WebSocket Endpoint

CVSS 7.1

CVE-2025-12082 HIGH

Drupal CivicTheme Design System < 1.12.0 - Incorrect Authorization

CVSS 7.5

CVE-2025-62259 MEDIUM

Liferay Portal 7.4.0-7.4.3.109 & DXP 2023.Q3.1-2023.Q3.4 - Unauthenticated API Access

CVSS 5.4

CVE-2025-11971 MEDIUM

GitLab 10.6.0-18.3.4, 18.4.0-18.4.2, 18.5.0 - Authenticated Unauthorized Pipeline Execution via Commit Manipulation

CVSS 6.5

CVE-2025-11888 LOW

ShopEngine Elementor WooCommerce Builder Addon - Info Disclosure

CVSS 2.7

CVE-2025-59048 HIGH

OpenBao AWS Plugin < 0.1.1 - Cross-Account IAM Role Impersonation via Duplicate Role Name

CVSS 8.1

CVE-2025-62394 MEDIUM

Moodle 4.5.0-4.5.6 and 5.0.0-beta-5.0.2 - Incorrect Authorization in Quiz Notification

CVSS 4.3

CVE-2025-62651 MEDIUM

Restaurant Brands International Assistant < 2025-09-06 - Incorrect Authorization in Bathroom Rating Interface

CVSS 6.5

CVE-2025-62648 MEDIUM

Restaurant Brands International Assistant < 2025-09-06 - Incorrect Authorization

CVSS 6.4

CVE-2025-62647 MEDIUM

Restaurant Brands International Assistant < 2025-09-06 - Incorrect Authorization via JWT AWS Upload URL Generation

CVSS 5.0

CVE-2025-48044 HIGH

ash 3.6.3-3.7.1 - Authentication Bypass via Policy Expression Handling

CVE-2025-6892 HIGH

Moxa EDR-G9010/EDR-8010/EDF-G1002-BP/TN-4900/NAT-102/NAT-108/OnCell G4302-LTE4 - Incorrect API Authorization

CVE-2025-62506 HIGH

MinIO < RELEASE.2025-10-15T17-29-55Z - Privilege Escalation via IAM Policy Validation Bypass

CVSS 8.1

CVE-2025-9955 MEDIUM

WSO2 Enterprise Integrator - Incorrect Authorization in SOAP Admin Services

CVSS 5.7

CVE-2025-10611 CRITICAL

WSO2 API Control Plane and API Manager - Incorrect Authorization via REST API Bypass

CVSS 9.8

CVE-2025-10545 LOW

Mattermost 10.5.0-10.5.10 and 10.11.0-10.11.2 - Incorrect Authorization via Channel Member Endpoint

CVSS 3.1

CVE-2025-54267 MEDIUM

Adobe Commerce 2.4.9-alpha2 2.4.8-p2 2.4.7-p7 2.4.6-p12 2.4.5-p14 2.4.4-p15 and earlier - Incorrect Authorization

CVSS 6.5

CVE-2025-54265 MEDIUM

Adobe Commerce <=2.4.9-alpha2 - Incorrect Authorization leading to Unauthorized Read Access

CVSS 5.9

CVE-2025-54263 HIGH

Adobe Commerce 2.4.9-alpha2 2.4.8-p2 2.4.7-p7 2.4.6-p12 2.4.5-p14 2.4.4-p15 and earlier - Incorrect Authorization

CVSS 8.1

CVE-2025-42939 MEDIUM

SAP S/4HANA - Authenticated Incorrect Authorization via Request Parameter Tampering

CVSS 4.3

CVE-2025-62243 MEDIUM

Liferay DXP 2023.Q3.1-2023.Q3.8 - Authenticated IDOR in Publications Comments

CVSS 5.4

CVE-2025-11581 MEDIUM

PowerJob < 5.1.2 - Missing Authorization in OpenAPIController

CVSS 5.3

CVE-2025-11580 MEDIUM

PowerJob < 5.1.2 - Unauthenticated Missing Authorization in /user/list Endpoint

CVSS 5.3

CVE-2025-48043 HIGH

ash < 3.6.2 - Authentication Bypass via Incorrect Authorization in Authorizer