The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
3,360 vulnerabilities with CWE-863
CVE-2026-62193
MEDIUM
OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install
CVSS 4.9
CVE-2026-62192
HIGH
OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass
CVSS 8.1
CVE-2026-62191
HIGH
OpenClaw 2026.6.6 < 2026.6.8 Authorization Bypass via Message Mutations
CVSS 7.1
CVE-2026-62190
HIGH
OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper
CVSS 8.8
CVE-2026-62188
HIGH
OpenClaw < 2026.6.9 Feishu Authorization Bypass
CVSS 8.1
CVE-2026-62187
HIGH
OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
CVSS 8.1
CVE-2026-62186
HIGH
OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override
CVSS 7.6
CVE-2026-58408
MEDIUM
ChurchCRM < 7.4.0 CSVCreateFile.php - Unauthorized Member PII Export
CVSS 6.5
CVE-2026-62147
MEDIUM
Tempo-operator: tempo operator: query rbac bypass
CVSS 6.5
CVE-2026-10106
MEDIUM
Mattermost 10.11/11.6/11.7 - Private Channel Post Action Authorization Bypass
CVSS 6.5
CVE-2026-15541
HIGH
will-moss Isaiah Master Websocket server.go Server.Handle authorization
CVSS 7.3
CVE-2026-15507
MEDIUM
coollabsio Coolify Policy Policies authorization
CVSS 6.3
CVE-2026-61874
LOW
filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
CVSS 3.1
CVE-2026-56252
MEDIUM
Capgo - Scope Isolation Failure in Webhook Test Endpoint
CVSS 5.4
CVE-2026-1359
HIGH
Genolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt
CVSS 8.8
CVE-2026-13238
MEDIUM
Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
CVSS 4.8
CVE-2026-13237
MEDIUM
AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
CVSS 4.8
CVE-2026-13232
LOW
Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
CVSS 3.1
CVE-2026-57218
MEDIUM
RabbitMQ AMQP 0-9-1 < 4.2.6 - Post-Revocation Message Disclosure
CVSS 6.5
CVE-2026-57217
MEDIUM
RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass
CVSS 6.5
CVE-2026-57215
HIGH
RabbitMQ Direct Reply-To - Unauthorized Reply-Channel Injection
CVSS 8.8
CVE-2026-55479
MEDIUM
Snipe-IT: Incorrect permission for legacy license checkin API
CVSS 4.3
CVE-2026-55475
MEDIUM
Snipe-IT: Import created_by can be overwritten
CVSS 5.7
CVE-2026-55462
MEDIUM
Snipe-IT: Authorization bypass on print inventory page
CVSS 4.3
CVE-2026-55472
MEDIUM
Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
CVSS 4.3
Details
Vulnerabilities
3,360
Exploit Likelihood
High