Incorrect Authorization
CWE-863
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
We track 1,736 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 23 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a default deny policy when defining these ACLs.
Latest Incorrect Authorization vulnerabilities
- 7.7 High severity
Apache Pulsar: Incorrect Authorization
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the
- 7.8 High severity
hMailServer: Incorrect Authorization
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains
- 7.5 High severity
hMailServer: Incorrect Authorization
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage_roles permission in named domains - a full-scope API key issued for those domains,
- 7.5 High severity
Hermes Agent: Incorrect Authorization
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization
- 7.1 High severity
zentaopms: Incorrect Authorization
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.
- 9.1 Critical severity
Acronis Cyber Infrastructure: Incorrect Authorization
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infr
- 8.4 High severity
OxygenOS: Exposed Dangerous Method or Function
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command st
- 9.9 Critical severity
Manila: Incorrect Authorization
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-auth
- 7.5 High severity
arcadedb: Incorrect Authorization
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can sub
- 7.1 High severity
Oracle SOA Suite: Incorrect Authorization
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT
- 9.6 Critical severity
Oracle SOA Suite: Incorrect Authorization
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome ext
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
- 9.6 Critical severity
Chrome: Incorrect Authorization
Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: M
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: