The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
3,360 vulnerabilities with CWE-863
CVE-2026-15752
HIGH
zhinianboke xianyu-auto-reply Backend User Endpoint users authorization
CVSS 7.3
CVE-2026-49981
HIGH
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
CVSS 8.2
CVE-2026-48808
HIGH
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
CVSS 7.5
CVE-2026-48807
CRITICAL
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
CVSS 9.1
CVE-2026-48806
CRITICAL
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
CVSS 9.1
CVE-2026-47732
MEDIUM
Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
CVSS 6.5
CVE-2026-46635
MEDIUM
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
CVSS 4.3
CVE-2026-59889
MEDIUM
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
CVSS 6.5
CVE-2026-48327
CRITICAL
Adobe ColdFusion 2025 - ColdFusion | Incorrect Authorization (CWE-863)
CVSS 9.0
CVE-2026-48321
CRITICAL
Adobe ColdFusion 2025 - ColdFusion | Incorrect Authorization (CWE-863)
CVSS 9.3
CVE-2026-50528
HIGH
Microsoft .NET 10.0 - .NET Security Feature Bypass Vulnerability
CVSS 8.2
CVE-2026-48489
HIGH
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
CVSS 7.5
CVE-2026-48349
HIGH
Adobe Animate 2023 - Animate | Incorrect Authorization (CWE-863)
CVSS 8.1
CVE-2026-48348
HIGH
Adobe Animate 2023 - Animate | Incorrect Authorization (CWE-863)
CVSS 7.7
CVE-2026-47998
MEDIUM
Adobe Commerce | Incorrect Authorization (CWE-863)
CVSS 5.9
CVE-2026-47997
MEDIUM
Adobe Commerce | Incorrect Authorization (CWE-863)
CVSS 5.9
CVE-2026-47996
HIGH
Adobe Commerce | Incorrect Authorization (CWE-863)
CVSS 7.6
CVE-2026-47988
HIGH
Adobe Commerce | Incorrect Authorization (CWE-863)
CVSS 8.6
CVE-2026-47984
HIGH
Adobe Commerce | Incorrect Authorization (CWE-863)
CVSS 8.2
CVE-2026-47303
HIGH
Microsoft .NET 10.0 - ASP.NET Core Elevation of Privilege Vulnerability
CVSS 8.8
CVE-2026-45075
HIGH
Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
CVSS 8.2
CVE-2026-15641
HIGH
Devolutions Server - Incorrect Authorization
CVSS 7.1
CVE-2026-9127
HIGH
Rockwell Studio 5000 Logix Designer - External Tools Authorization Bypass Code Execution
CVE-2026-62198
MEDIUM
OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search
CVSS 4.3
CVE-2026-62196
HIGH
OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs
CVSS 8.3
Details
Vulnerabilities
3,360
Exploit Likelihood
High